Revolut confirmed on September 12 that it had disclosed sensitive customer information to an unauthorised third party after receiving fraudulent data requests sent from what appeared to be a legitimate government agency email domain.
The company described the incident as a “sophisticated external impersonation scam”. It said the spoofed messages passed SPF, DKIM and DMARC authentication checks, allowing the requests to appear credible during the company’s handling of them.
The information disclosed included customers’ birth date, postal and email addresses, and phone numbers. It also included copies of identity documents, including passports and driver’s licenses, along with transaction histories and account statements.
Revolut said a “very limited” number of customers were affected and that it had notified them. The company did not disclose the exact number of people whose information was shared.
Customer notifications began circulating around September 11, one day before Revolut publicly confirmed the breach. Reports suggest a select group of higher-net-worth individuals may have been specifically targeted, although Revolut has not publicly set out which customers were selected or how the fraudulent requests were processed.
Upon detecting the incident, Revolut said it immediately blocked the fraudulent address. It also alerted the relevant government agency, enforcement agencies, data protection authorities and financial regulators.
A Revolut spokesperson said: “Revolut systems and customer funds are unaffected”. The company also said no customer funds were stolen and its core banking systems were not compromised.
Revolut further stressed that no biometric facial telemetry data was disclosed during the incident. It has not publicly identified the government agency whose domain was spoofed, the unauthorised third party that received the information, or how the attackers obtained the capability to send requests that passed the authentication checks.
The episode concerns the handling of requests that carry the apparent authority of a public body. SPF, DKIM and DMARC checks are designed to assess aspects of email authenticity, yet the messages in this case passed those checks and were treated as legitimate requests for customer information.
The available information leaves several central questions unresolved. Revolut has not said whether the disclosed data has been misused or is circulating in criminal markets. It has also not released investigation findings or a timeline showing how the requests were initially accepted.
The company’s account establishes that personal information, identity documents and financial records were disclosed. It maintains that the breach did not extend to customer funds, biometric facial telemetry data or its core banking systems.
Comments (0)