Technology and Science12 September, 20263 min read
Revolut Disclosed Passports And Bitcoin Records After Fake Government Requests From Legitimate Email Domain
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Revolut disclosed passport copies, identity documents, and Bitcoin transaction histories after fake government request. Fraud used legitimate government agency email domain; Revolut detected and blocked the address.
9 outlets told this the same way.
Fake agency email triggers leak
British fintech Revolut confirmed it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent requests sent from a legitimate government agency email domain. Reuters reported that the company said, "Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators," and it added that "Revolut systems and customer funds are unaffected." TechCrunch, reviewing a notification emailed to affected customers, said the exposed data included customers’ birth date, postal and email addresses, and phone numbers, along with copies of identity documents including passports and driver’s licenses.
TechCrunch also reported that the data may have included verification selfies, account statements, and transaction histories, while Revolut told TechCrunch that it had identified a "sophisticated external impersonation scam" involving the legitimate agency domain. The incident was described by TechCrunch as a disclosure that came after Revolut treated the request as genuine, and it said Revolut did not disclose the exact number of impacted individuals or the government agency involved.
Limited victims, targeted profile
Revolut told TechCrunch that a "limited" number of customers were impacted and that it had contacted those customers directly, while it declined to disclose whether the incident was limited to a specific market. TechCrunch reported that well-known crypto security researcher ZachXBT posted about the email to affected customers late on Friday and said the incident appeared to have been targeted at high net worth users. In a customer notification circulated by ZachXBT, Revolut received a request for customer information that appeared to come from a government agency, sent from an unauthorized email account using the agency's official domain, according to Decrypt.
Decrypt said the exposed data spanned identity details such as full name, date of birth and occupation, contact information including postal address, email and phone number, and document and verification data including a copy of the victim's passport or driver's license and the selfie provided for verification. Decrypt further said the financial data included account statements with IBAN and wallet reference numbers, withdrawal records and full transaction history, including Bitcoin, while Revolut said no biometric facial telemetry data was involved.
What was exposed, what’s next
TechCrunch said Revolut’s notification indicated the exposed information included identity and contact details, copies of passports and driver’s licenses, and that it may have included verification selfies, account statements, and transaction histories. Reuters said Revolut confirmed the compromised data included customers' birth date, postal and email addresses, and phone numbers, and it reported that Revolut declined to disclose the exact number of individuals affected by the breach. Decrypt said the exposed financial records included IBANs, withdrawal records and complete transaction histories, as well as Bitcoin transactions, and it reported that Revolut said its systems and customer funds were unaffected.
The Block reported that Revolut’s spokesperson described the incident to the outlet as a "sophisticated external impersonation scam" and said Revolut blocked the email address after identifying it. The Block also said Revolut had not disclosed the number of affected customers or identified the agency, while it reported that the information disclosed may have included names, dates of birth, postal and email addresses, telephone numbers, and copies of identity documents including passports and driver's licenses.