Revolut, the digital banking and financial services platform, has disclosed that an unauthorised third party exploited an email account tied to a legitimate government agency domain to submit fraudulent requests for customer data, a detail brought to light by crypto investigator ZachXBT, who published a notification the company had distributed to affected customers. The company reported that its internal infrastructure remained secure and that no client funds had been impacted.
Personal details potentially exposed include full names, birth dates, home addresses, contact numbers, email accounts, identity document scans such as passports and driving licences, and identity verification photographs. Notices sent to a portion of those affected indicated that personal financial data — including account statements, IBANs, withdrawal records, full transaction histories, and Bitcoin activity — may have been accessed without authorisation.
The company has not provided details on the number of affected users or the identity of the government agency whose email domain was exploited. Upon identifying the fraudulent activity, the organisation deactivated the associated email account. According to blockchain analyst ZachXBT, the breach appeared to focus on wealthy account holders, though Revolut has not confirmed that assertion. The platform has built a global user base of over 80 million people.
Denis Calderone, CTO of Suzu Labs, noted that the threat actor had not impersonated a government email address. Access was gained through a verified government agency's email network, with the request transmitted from within that infrastructure. The authentication check returned a successful result.
According to reports, Revolut's compliance team treated the submitted paperwork as sufficient authorisation to transfer passports, driving licences, identity photographs, full transaction histories including cryptocurrency dealings, IBANs, and withdrawal records belonging to what appeared to be a targeted subset of high-net-worth customers. The process involves receiving the request, authenticating it through a separate channel, returning the call to a recognised number, and obtaining authorisation.
Available data indicates that the harm facing those whose information was exposed could exceed the impact of a monetary fraud loss. As Calderone noted, once passport data is exposed, that exposure cannot be reversed. The FBI's November 2024 Private Industry Notification on fraudulent data requests outlined a framework that analysts have noted applies to this situation. While that guidance addressed emergency requests specifically, its underlying principles apply equally to routine government data requests, particularly where the information involved is of a sensitive nature.
The FBI advised businesses to evaluate the legitimacy of urgent data requests before complying, and to follow up directly with the requesting party and the originating authority — noting that whether a request arrives through expedited or routine legal channels, the information disclosed remains the same. Identity documents, biometric records, and detailed financial histories retain their value to unauthorised parties regardless of whether the original data request appeared routine.
John Strand, owner of Black Hills Information Security, Inc., noted that the incident underscores how the human element remains one of the more accessible entry points for data access regardless of how advanced defensive technologies or attack methods become. He added that what distinguishes this particular case is the degree to which the attackers focused their efforts on a specific target. The perpetrators appeared to possess working knowledge of standard procedures, how those systems functioned, and the routes through which such requests would ordinarily be submitted — a level of familiarity that analysts note would be necessary for anyone attempting to execute an operation of this nature.
Capuano, Director of SOC Operations at Black Hills Information Security, noted that Revolut had characterised the incident as an advanced external impersonation scheme, adding that the episode reinforced the view that technology on its own cannot address such threats. The message traced back to a legitimate government agency address and cleared every verification step Revolut ran against it. Both SPF and DKIM are authentication protocols that verify whether an email originates from its stated source.
Revolut's alert disclosed that the transfer was processed because the request passed domain authentication verification. The organisation's position that its infrastructure was not breached may be technically accurate, yet the attacker used verified identity as a substitute for authorised access, according to analysts. The information was transferred through a mechanism that functioned as intended.
At many organisations, requests from authorities and law enforcement typically flow into a shared inbox, are handled by a designated compliance officer, and carry a response deadline. Callbacks to independently verified numbers, secondary approval, and audit trails visible to the security operations centre are typically absent from the process. When a compliance department forwards passport scans, identity verification images, and complete transaction records to an external address, no automated notification is triggered, as this falls within the team's standard operating procedures.
Security resources are concentrated at entry points while data exits through less monitored channels. A passport number, date of birth, and the photograph submitted during account registration do not expire on a fixed schedule. The credentials involved are precisely the type of documentation that financial institutions routinely use to confirm identity and restore account access, leaving affected individuals more vulnerable to impersonation across their other banking relationships. Combined with complete transaction records and cryptocurrency data, such a dataset would constitute a detailed profile of potential targets along with an assessment of their financial exposure.
According to blockchain analyst ZachXBT, the breach appears to have been directed at affluent account holders, a claim Revolut has neither confirmed nor denied, though the nature of the data reportedly requested would be consistent with that profile. Procedures such as independent out-of-band verification, callbacks to pre-confirmed agency contacts, and dedicated legal request intake portals have been cited by analysts as baseline measures for government data requests involving sensitive customer records, not only those flagged as time-sensitive.
Donald McFarlane, a board member at Xcape Inc., noted that while financial institutions may be obligated to retain certain identity-related data, that obligation reinforces the case for tighter controls and data minimisation practices. McFarlane added that disclosing passports, transaction records, and other protected customer information solely on the basis of a request originating from a government email address would not be appropriate. Possessing a government domain name does not replace the need to verify a warrant's legitimacy, confirm its legal standing, or employ a protected method for transferring the requested data, he said.
