Revolut disclosed customer passports, verification selfies, and Bitcoin transaction histories after processing a fraudulent government data request that carried valid email authentication credentials.
Customers were notified Friday that disclosed information may include passport or driver's license copies, verification selfies, names, dates of birth, occupations, home addresses, phone numbers, IBANs, and account statements. Withdrawal records and complete transaction histories, including Bitcoin activity, were potentially released.
The fraudulent request originated from an unauthorized mailbox operating within the actual email infrastructure of a genuine government agency. The email passed SPF, DKIM, and DMARC authentication checks, suggesting the attacker had access to the agency's legitimate email system rather than simply spoofing the sender address. Revolut fulfilled the request believing it was authentic and only discovered the fraud after contacting the agency directly. The company then blocked the sender and began notifying customers and regulators.
Revolut has not identified which government agency was compromised or disclosed how many customers were affected.
Compliance and Customer Data Tension
The incident has raised questions about how much information financial institutions collect from customers and what controls exist when government entities request data access. Banks and fintech firms maintain extensive identity and transaction records to comply with know-your-customer and anti-money laundering requirements, creating sensitive databases that link verified identities and residential information to cryptocurrency activity.
For Bitcoin holders, the combination of exposed identity documents, contact information, and residential addresses presents particular risk. Bitcoin transactions are publicly recorded on the blockchain, meaning information connecting a known person to specific transactions could help map their broader onchain activity.
Onchain investigator ZachXBT, who publicized the incident, suggested the disclosure appeared limited in scale and may have targeted high-net-worth customers, though Revolut has not provided figures to establish the scope.
No customer funds have been reported stolen. Revolut's notices confirmed that passwords, card PINs, and cryptocurrency private keys were not included in the disclosed information.
Unanswered Questions About Verification
The method used to access information raises concerns for other financial institutions that may have received requests from the same unauthorized mailbox. Former Mt. Gox CEO Mark Karpelès argued that identifying the compromised government agency would allow banks and exchanges to determine whether they also received information demands from the same source.
Revolut has withheld the agency's identity while investigating. The company has not explained whether government information requests require confirmation outside email, why it contacted the agency only after releasing records, or whether it has changed verification procedures since discovering the fraud.
