Revolut Exposes Customer Records After Fake Government Agency Request

Revolut, a global banking app with over 80 million customers, has revealed that it inadvertently disclosed sensitive customer information to an unauthorized party. The disclosure was made in response to a fake request from what appeared to be a government agency's email domain.

The unauthorized sender used a valid domain authentication credential to trick Revolut into providing customer data, including full names, dates of birth, occupations, postal addresses, email addresses, and telephone numbers. Additionally, the company disclosed copies of identity documents such as passports or driver's licenses, along with verification selfies.

The request also included account statements that listed IBANs, account status, account-opening dates, and Bitcoin wallet reference numbers. Moreover, Revolut provided withdrawal records and full transaction histories, including Bitcoin transactions.