Revolut discloses customer passports and Bitcoin transaction histories after falling for fake government request

Digital banking giant Revolut has disclosed sensitive customer data, including passport copies, verification selfies, and full Bitcoin transaction histories, after falling for a fraudulent government information request. The sophisticated scam utilized an authorized mailbox within a genuine government agency's domain, passing SPF, DKIM, and DMARC checks. While Revolut states customer funds are safe, the incident has drawn sharp criticism from users and privacy advocates who argue that extensive compliance data collection creates severe security risks.

Revolut fraudulent data disclosure incident

• ▪Digital banking giant Revolut disclosed sensitive customer data to a malicious actor after fulfilling a fraudulent government request for information
• ▪A Revolut spokesperson confirmed the incident was a sophisticated external impersonation scam, stating that systems and customer funds remained unaffected
• ▪Revolut blocked the sender's email address, contacted the impersonated government agency, and notified affected users, law enforcement, and regulators after discovering the fraud

Fake government request authentication failure

• ▪The fraudulent email passed SPF, DKIM, and DMARC authentication checks because the attacker had access to an authentic mailbox within the government agency's email infrastructure
• ▪The fraudulent email request received by Revolut originated from an unauthorized mailbox operating inside the actual domain infrastructure of a genuine government agency
• ▪Revolut has withheld the identity of the compromised government agency, citing an ongoing police investigation

Exposed customer data scope

• ▪Revolut stated that passwords, card PINs, cryptocurrency private keys, and biometric facial telemetry data were not exposed in the disclosure
• ▪The financial records exposed in the Revolut incident included IBANs, account statements, withdrawal records, and full transaction histories, including Bitcoin activity
• ▪The data disclosed by Revolut included passport or driver's license copies, verification selfies, names, dates of birth, occupations, home addresses, phone numbers, and emails

High-net-worth customer targeting

• ▪Onchain investigator ZachXBT publicized the incident and stated that the data disclosure appeared limited in scale and targeted high-net-worth customers
• ▪Former Mt. Gox CEO Mark Karpelès circulated a copy of the Revolut notification on September 12, 2026, arguing that identifying the compromised agency would help other institutions

Financial compliance data collection

• ▪Critics and social media users argued that the Revolut incident demonstrates how extensive know-your-customer (KYC) and anti-money laundering compliance databases create severe security risks for users
• ▪Marc Zeller, founder of the Aave Chan Initiative, criticized Revolut, stating the disclosure occurred shortly after Revolut threatened to close his account if he did not provide extensive personal data

Debatable claims

• ▪Revolut should publicly identify the compromised government agency
• ▪Extensive KYC requirements create unacceptable security risks for financial customers