Revolut Confirms Disclosure of Sensitive Customer Data in Sophisticated Impersonation Scam

British fintech giant Revolut has confirmed that it inadvertently disclosed sensitive customer information to an unauthorized third party. The breach occurred following a sophisticated external impersonation scam, where the attackers utilized a legitimate government agency email domain to submit fraudulent requests for customer data. This incident has raised concerns about data security in the rapidly expanding fintech sector, particularly for a company eyeing a significant public listing and global banking expansion.

The exposed data is extensive and highly sensitive, encompassing a wide range of personal and financial details. According to a notification emailed to affected customers, which was reviewed by TechCrunch, the compromised information included customers’ identity and contact particulars such. This category of data typically includes full names, birth dates, postal addresses, email addresses, and phone numbers. More critically, the breach also involved copies of customers’ official identity documents, such as passports and driver’s licenses. These documents are cornerstone elements for identity verification and their compromise poses substantial risks. Furthermore, the firm’s notification indicated that the data may have also included verification selfies, which are often used in Know Your Customer (KYC) processes to confirm a user’s identity against their official documents. To compound the potential risks, account statements and transaction histories may also have been exposed, providing attackers with insights into customers’ financial activities and potentially enabling further targeted fraud.

A spokesperson for Revolut confirmed the incident to TechCrunch, stating that a "limited" number of customers were impacted. The company has already initiated direct contact with these affected individuals to inform them of the breach. However, Revolut declined to disclose the exact number of individuals affected by the incident, nor did it specify whether the breach was confined to a particular market or reveal the identity of the government agency whose domain was impersonated. The lack of specific numbers, while common in the immediate aftermath of such incidents, can fuel uncertainty among the broader customer base.

The modus operandi of the breach underscores the evolving sophistication of cyber threats. Revolut described it as a "sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information." This method is particularly insidious because the use of a seemingly authentic government email domain lends an air of legitimacy to the fraudulent requests, making them exceptionally difficult for even vigilant employees to identify as malicious. Such tactics exploit trust in official communications and can bypass standard email security filters that might flag generic phishing attempts. The specific nature of the fraudulent requests, whether they were for individual customer records or bulk data, remains undisclosed, but the outcome was the unauthorized transfer of sensitive information.

Upon discovering the scam, Revolut promptly took decisive action to mitigate further damage. The company immediately blocked the email address from which the fraudulent requests originated, thereby cutting off the unauthorized third party’s communication channel. Furthermore, Revolut alerted the relevant government agency whose domain was exploited, law enforcement authorities, and pertinent regulatory bodies. This proactive notification to authorities is a standard, yet crucial, step in responding to data breaches, ensuring that investigations can commence and broader preventative measures can be considered. Crucially, Revolut affirmed that "Revolut systems and customer funds are unaffected." This statement aims to reassure customers that the incident was a data disclosure via fraudulent requests, rather than a direct compromise of Revolut’s internal IT infrastructure or the theft of funds directly from customer accounts held within Revolut’s systems. However, the exposure of sensitive data still presents significant risks for customers, including potential identity theft, targeted phishing attacks, and financial fraud originating from third parties leveraging the stolen information.

London-based Revolut is a major player in the global fintech landscape, boasting an impressive user base of more than 80 million customers worldwide. The company operates as a licensed bank in over 30 countries, a testament to its ambitious growth strategy and regulatory compliance efforts across diverse jurisdictions. In line with its expansion, Revolut has recently broadened its presence in key international markets, including India, Mexico, France, and the UAE, tapping into burgeoning digital economies. A significant milestone in its journey was achieved earlier this month when the U.S. Office of the Comptroller of the Currency (OCC) granted conditional approval for Revolut to establish a national bank in the United States. This highly anticipated move is expected to materialize with the bank’s launch in the first half of 2027, marking a pivotal step in solidifying its footprint in one of the world’s largest financial markets. The incident, therefore, comes at a critical juncture for the company as it navigates complex regulatory environments and seeks to build trust with new and existing customers globally.

The news of Revolut’s data disclosure first gained wider public attention late on a Friday, when ZachXBT, a well-known crypto security researcher, posted about Revolut’s email notification to its affected customers. ZachXBT’s immediate analysis suggested that the incident appeared to have specifically targeted high net worth users. If true, this detail indicates a more strategic and potentially lucrative motivation behind the attack, as high net worth individuals are often targets for more sophisticated financial fraud and identity theft schemes. The involvement of independent security researchers like ZachXBT plays a vital role in promptly disseminating information about such incidents, often before official public statements are widely distributed, and providing additional context or analysis that can be crucial for affected individuals.

The timing of this data disclosure incident is particularly sensitive for Revolut, as the company is reportedly exploring the possibility of a public listing. Market speculation suggests that an eventual Initial Public Offering (IPO) could value the fintech at an astonishing sum of up to $200 billion. This projected valuation represents a substantial increase from its last reported private valuation of $75 billion in November, underscoring the rapid growth and investor confidence Revolut has garnered. A data breach, even if limited in scope and contained in terms of system compromise, can introduce complexities into the IPO process. Potential investors and regulatory bodies often scrutinize a company’s cybersecurity posture and incident response capabilities, as these directly impact brand reputation, customer trust, and long-term financial stability.

Furthermore, Revolut has been actively expanding its banking footprint across Europe and other regions, successfully securing banking licenses in countries like France and the UK in recent months. These licenses are hard-won and reflect a commitment to meeting stringent regulatory requirements for financial institutions. An incident involving the disclosure of sensitive customer data, particularly through an impersonation scam that exploits trust in official communications, could invite increased scrutiny from these regulatory bodies. Maintaining a robust cybersecurity framework is not just a matter of good business practice but a fundamental prerequisite for operating as a licensed bank in highly regulated markets.

In conclusion, Revolut’s confirmation of the data disclosure highlights the persistent and evolving threat landscape faced by financial technology companies. While the company has assured that its systems and customer funds remain unaffected, the exposure of deeply personal and financial information poses considerable risks to the "limited" number of customers impacted. Revolut’s swift actions in blocking the fraudulent source and notifying authorities are positive steps, but the incident will undoubtedly serve as a critical test of its resilience, customer communication, and ongoing commitment to security as it continues its ambitious global expansion and prepares for a potential public market debut. The incident also serves as a stark reminder for both financial institutions and their customers about the need for extreme vigilance against sophisticated social engineering and impersonation scams that increasingly leverage seemingly legitimate channels.