Revolut handed customer data to scammers impersonating a government agency

Fake data requests came from a real government agency domain. Copies of passports and driver’s licenses of some customers were sent to an unauthorized person, and possibly also their transaction histories.

Revolut, the British financial technology company (fintech) with more than 80 million customers, confirmed on Saturday, 12 September, that it had handed sensitive data of some customers to an unauthorized person. The scammer sent information requests from an email address in a real government agency domain. The company confirmed the incident to TechCrunch (opens in a new tab).

A notice Revolut sent to affected customers shows that dates of birth, postal and email addresses, phone numbers, and copies of identity documents, including passports and driver’s licenses, were disclosed. Selfie photos taken during identity verification, account statements, and transaction histories may also have been leaked.

A Revolut spokesperson described the number of affected customers as “limited,” but did not provide a figure. The company also did not disclose which agency the scammer impersonated, or whether the incident concerned a single market. According to Revolut, the scammer’s email address has been blocked, and the agency, law enforcement, and regulators have been notified. The company says its systems and customers’ funds were not compromised.

The messages sent to customers were reported late Friday night, 11 September, by ZachXBT, an independent cryptocurrency security researcher. In his view, the attack appeared to target wealthy customers.

The incident occurred during a period of rapid expansion for Revolut. The company operates as a bank in more than 30 countries, obtained banking licenses in France and the United Kingdom in recent months, and at the beginning of September received conditional approval from the U.S. banking regulator (Office of the Comptroller of the Currency) to establish a bank in the United States. Revolut is also considering a stock market listing. According to TechCrunch, its valuation could reach 200 billion dollars, compared with 75 billion dollars in November 2025; earlier Reuters reports in April spoke of about 172 billion euros.

The attack did not require breaking into the systems. It exploited the ordinary procedure for responding to government requests for customer data. Companies processing personal data can check whether such requests are confirmed through a channel other than the sender’s email address alone, for example by calling the institution that supposedly sent them.