Revolut customer data phishing via a fake email address

Revolut confirms data breach affecting some customers after attack using fake requests

Revolut has confirmed a breach of sensitive data belonging to some of its customers. According to the description of the incident, fraudsters used an email address from the legitimate domain of a government institution and, through it, sent the company fake requests for information.

The fintech says Revolut’s systems and customer funds were not compromised. That means the incident itself did not lead to money being taken from users’ accounts, but it may have opened the door to further fraud attempts.

The company confirmed that an unauthorized third party gained access to sensitive information relating to a limited number of users, Bloomberg reports. Revolut did not say exactly how many customers were affected. The company also said it had contacted directly the people whose data may have been exposed and offered them support.

The attack method was especially dangerous because the criminals did not need to break directly into the company’s systems. They used a real domain belonging to a government institution, which made their requests appear genuine. Revolut said it received fake information requests and did not recognize them as part of a scam.

According to information provided by Reuters and reports from other media outlets, the leaked data may have included dates of birth, postal and email addresses, phone numbers and occupation details. Documents used for identity verification were also in scope, including copies of passports and driving licences. There are also reports of a possible leak of photos taken during verification, account statements, transaction histories, IBAN numbers and data related to bitcoin transactions.

Revolut has not publicly confirmed the full list of information that was exposed, or the number of people affected by the incident. The company said that after discovering the scheme, it immediately blocked the address used and passed the case to the relevant government agency, law enforcement, data protection bodies and financial regulators. Among those who drew attention to the case was ZachXBT, an analyst who tracks transactions and scams in the cryptocurrency world.