Revolut discloses customer data leak after email scam

Revolut has disclosed that a limited number of customers had sensitive personal and financial information exposed after the fintech company responded to fraudulent requests sent from an unauthorised account operating within a legitimate government agency’s email domain.

The company said the requests appeared authentic because they came from an official government domain and carried valid domain authentication credentials. Revolut later determined that the email account had been created or controlled without authorisation and had been used to obtain customer information under the guise of an official request.

Affected customers were notified directly. Information potentially disclosed included names, dates of birth, postal and email addresses, telephone numbers, occupations and copies of identity documents such as passports and driving licences, according to the notice sent by Revolut. Verification selfies, account statements, International Bank Account Numbers, withdrawal records and full transaction histories, including Bitcoin transactions, may also have been provided.

Revolut said its systems were not compromised and customer funds were unaffected. The company has not disclosed the exact number of people involved, the country in which the affected government authority is based, the identity of the agency whose domain was used, or whether the incident was confined to a single market.

Revolut said it contacted the affected customers directly rather than issuing a figure for the incident’s scale. The company has also declined to say whether the fraudulent requests targeted particular account holders or customer categories, leaving the scope and selection method unclear while authorities examine how the official email account was misused.

A spokesperson described the incident as a sophisticated external impersonation scam and said the email address involved was blocked after the problem was identified. Revolut also said it had alerted the relevant government agency, law-enforcement bodies, data protection authorities and financial regulators.

The disclosure became public after customers began sharing copies of an “Urgent security update” from Revolut on Friday. Former Mt. Gox chief executive Mark Karpelès said he had received the notice and published excerpts showing that the company had processed an information request it initially believed to be genuine.

The notification said Revolut contacted the government agency to verify the request and, during that process, alerted the authority to the existence of an unauthorised account on its domain. Revolut said precautionary protection measures were then applied to affected customer accounts.

The episode differs from a conventional intrusion in which attackers penetrate a company’s own computer systems. The available information indicates that the scam relied on trusted email infrastructure and social engineering, presenting requests that appeared to satisfy normal authentication checks because they originated from a genuine government domain.

That distinction is significant because financial institutions routinely receive lawful requests for customer records from courts, regulators and law-enforcement agencies. Revolut’s public contact guidance instructs competent authorities and legal representatives to send official court orders and requests for information to a dedicated company address, creating a process in which the apparent legitimacy of the sender is an important part of verification.

The company has not said when the fraudulent requests were received, how many requests were processed or how long the unauthorised government-domain account remained active. It also has not stated whether the information was subsequently used for fraud, identity theft or attempts to compromise customer accounts.

Revolut’s notice did not indicate that passwords, card PINs or customer balances had been exposed. The company said customers’ money remained secure, while the data disclosure raised a separate risk because identity documents, contact details and transaction records can be used to craft targeted scams or impersonation attempts.

The company advises customers to use its secure in-app support channels for confidential matters and to report suspicious activity promptly. It also tells users not to share security details and to be cautious about messages seeking confidential information or demanding urgent action.