Revolut Discloses Customer Data to Unauthorized Party After Fake Government Email
Revolut, one of Europe's largest digital banks, has disclosed that it handed over customers' personal data to an unauthorized third party after receiving a fake government request via email.
The fintech company says the email appeared legitimate and passed standard authentication checks, but was actually a sophisticated external impersonation attack.
The data disclosed included copies of identity documents such as passports and driver's licenses, along with selfies customers submitted for identity verification, account statements, IBANs, and Bitcoin wallet reference numbers.
No login credentials, passwords, or account access were compromised, but the exposed records contain sensitive information that could be used to target phishing attacks or fraudulent account creation.