Revolut Disclosed Sensitive Customer Info After Receiving Fake Government Emails

Revolut has confirmed that it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent requests sent from a legitimate government agency email domain. The exposed data included customers' identity and contact details, including their birth date, postal and email addresses, and phone numbers, as well as copies of their identity documents including passports and driver's licenses, according to a notification emailed to affected customers and reviewed by TechCrunch. A limited number of customers were impacted, with Revolut contacting those customers directly, but the exact number of individuals affected remains unknown. Revolut's systems and customer funds are reportedly unaffected, the company said. The incident was likely targeted at high net worth users, according to crypto security researcher ZachXBT, who posted about the email notification late on Friday. Revolut has over 80 million customers globally and operates as a bank in more than 30 countries, per its website. The fintech has recently expanded its presence in markets including India, Mexico, France, and the UAE, and has also been weighing a potential public listing that could value it at up to $200 billion. A conditional approval for a national bank in the US was granted earlier this month, with the firm expecting to launch in the first half of 2027. Revolut has not disclosed the government agency involved in the incident, and the company's response to the breach has been met with criticism from some experts. The incident highlights the need for greater scrutiny of government agency emails and the potential for impersonation scams. Revolut's notification to affected customers includes the following details: customers' identity and contact details, including birth date, postal and email addresses, and phone numbers, as well as copies of their identity documents, verification selfies, account statements, and transaction histories. The company has blocked the email address after discovering the scam and alerted the relevant government agency, law enforcement, and financial regulators. The incident is the latest in a series of high-profile data breaches in the fintech industry. Revolut has been expanding its banking footprint in Europe and globally, securing banking licenses in France and the UK in recent months. The company's response to the breach has been swift, with Revolut contacting affected customers directly and taking steps to block the email address and alert relevant authorities.