Revolut confirms data breach via fraudulent government requests

Revolut, one of Europe’s largest fintechs with over 80 million customers worldwide, has confirmed a data breach after receiving fraudulent requests from an unauthorized third party.

Sophisticated attack impersonating government agencies

According to notifications sent to affected customers, Revolut disclosed sensitive information after receiving fraudulent requests sent from a legitimate government agency email domain. The attacker used sophisticated spoofing techniques, making the requests appear to come from an official source.

The leaked data includes:

• Personal information: date of birth, email addresses, phone numbers, postal addresses
• Identity verification documents: passports, driver’s licenses
• Potentially: verification selfies, account statements, transaction histories

Revolut declined to disclose the exact number of affected customers and did not indicate whether the incident was limited to a specific market. The company also did not reveal which government agency was impersonated.

Revolut’s response

A Revolut spokesperson stated: “Revolut recently identified a sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information.”

After discovering the incident, Revolut took the following actions:

• Blocked the email address used in the scam
• Notified the relevant government agency
• Reported to law enforcement and regulatory authorities
• Contacted affected customers directly

The company emphasized that its systems and customer funds were not affected.

Revolut’s expansion context

London-based Revolut currently operates as a bank in more than 30 countries. The company has recently expanded aggressively, entering markets including India, Mexico, France, and the UAE.

Notably, earlier this month, the U.S. Office of the Comptroller of the Currency (OCC) granted conditional approval for Revolut to establish a national bank in the United States—a significant milestone in the company’s global expansion strategy.

Lessons for the fintech industry

This incident highlights several challenges in fintech security:

1. Increasingly sophisticated government impersonation attacks

Attackers are not just spoofing ordinary emails but using legitimate government agency domains. This demonstrates a high level of sophistication and access to official resources.

2. Need to strengthen legal request verification processes

Fintechs frequently receive information requests from law enforcement and government agencies. However, when attackers can cleverly spoof sources, the processes for verifying these requests need to be reviewed.

3. Impact on customer trust

With over 80 million global customers, any data breach can impact trust—a critical factor in the financial industry. How Revolut handles this incident will affect the company’s reputation.

Implications for the market

The fintech market is developing rapidly with the entry of many digital banks. This incident serves as a reminder of the importance of customer information security—essential for maintaining trust in financial markets.

Financial institutions need to strengthen their verification processes when handling requests from government agencies and regulators. Especially as digitalization advances, mechanisms to confirm the authenticity of requesters have become increasingly important.

Conclusion

Revolut’s data breach is not just a problem for one company but a lesson for the entire fintech industry. As cyber attacks become increasingly sophisticated, strengthening security processes and verification has become more urgent than ever.

For customers, the incident is a reminder of the importance of monitoring accounts and being alert to unusual signs. For the fintech industry, this is a call to action to build more robust security systems, especially when handling sensitive requests from government agencies.

---

Source: Revolut confirms customer data breach through fake government requests — TechCrunch, September 12, 2026