Overview
- Revolut disclosed Monday that a sophisticated impersonation scam used a real government‑domain email with valid authentication to request and receive customer records from the company.
- About 680 customers were contacted as affected after the fraud exposed passports or driver’s licences, verification selfies, names, addresses, phone numbers and email addresses.
- Attackers also obtained sensitive financial information, including IBANs, account statements, withdrawal records and on‑chain crypto transaction histories, and have published some records on Telegram while seeking payment.
- Revolut says its core systems, internal databases and customer funds were not compromised and that it blocked the malicious address, notified the implicated agency, regulators and law enforcement, and warned affected users.
- UK regulators including the FCA and the ICO have opened inquiries and the case highlights a verification gap where email authentication like DKIM can fail when attackers control or create mailboxes inside trusted domains, raising wider risks for KYC and crypto data linkage.