Revolut Says Impersonator Tricked It Into Sharing Customer Financial and Identity Data
Summary
Revolut says it sent customer identity documents, selfies, contact details, account statements, and transaction histories to an attacker impersonating a government agency. The company says a limited number of customers were affected and systems and funds were unaffected
Key points
- The attacker requested customer information by email while impersonating a government agency, using a domain with valid authentication credentials.
- Data shared included names, contact details, passports or driver’s licenses, selfies, account statements with IBANs, withdrawal records, and transaction histories, including Bitcoin transactions.
- Revolut said the breach affected a limited number of customers but did not disclose an exact count.
- The company said it blocked the address and notified the relevant government agency, law enforcement, data protection authorities, and financial regulators.
- Revolut said its systems and customer funds were unaffected.
- Crypto fraud investigator ZachXBT suggested high-net-worth users may have been targeted; this was not presented as a confirmed finding.
Article Details
- Victim Organization
- Revolut
- Incident Type
- Social engineering through impersonation of a government agency, resulting in unauthorized disclosure of customer data
- Data Types Exposed
- Full names
- Dates of birth
- Occupations
- Postal addresses
- Email addresses
- Telephone numbers
- Passport and/or driver’s license copies
- Facial verification images (selfies)
- Account statements, including IBAN numbers
- Withdrawal records
- Full transaction history, including Bitcoin transactions
- Affected Records
- An undisclosed, limited number of customers; exact number not provided.
- Operational Impact
- Revolut said its systems and customer funds were unaffected. It said it blocked the address and notified relevant agencies and regulators.
- Claim Status
- confirmed