Revolut Discloses Customer Data Breach After Fraudulent Gove

British fintech giant Revolut has confirmed a significant security incident in which sensitive customer information was disclosed to an unauthorized third party. The breach occurred after the company received fraudulent requests sent from a legitimate government agency email domain, raising serious concerns about sophisticated impersonation tactics targeting financial institutions.

According to a notification emailed to affected customers and reviewed by TechCrunch, the exposed data included a wide range of personal information. Consequently, customers’ identity and contact details-such as birth dates, postal addresses, email addresses, and phone numbers-were compromised. Furthermore, the breach may have included copies of identity documents, including passports and driver’s licenses.

In addition to these basic details, the notification revealed that verification selfies, account statements, and transaction histories may have also been exposed. However, Revolut emphasized that its systems and customer funds remained unaffected by the incident.

Limited Impact, Undisclosed Scale

A Revolut spokesperson confirmed to TechCrunch that a “limited” number of customers were impacted by the breach. Nevertheless, the company declined to disclose the exact number of affected individuals. Moreover, Revolut did not answer whether the incident was confined to a specific market or region.

“Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information,” the spokesperson said.

The company has not revealed which government agency’s email domain was compromised or exploited in the attack. This lack of transparency has left security experts questioning the full scope of the breach and whether similar tactics could be used against other financial institutions.

Swift Response and Notification

Upon discovering the scam, Revolut took immediate action to contain the damage. The fintech firm blocked the fraudulent email address and alerted the relevant government agency whose domain had been misused. In addition, the company notified law enforcement agencies and relevant regulatory bodies about the incident.

As a result of the breach, affected customers received direct notifications from Revolut detailing what information may have been compromised. The company has contacted those customers individually to inform them of the potential risks associated with the data exposure.

Well-known crypto security researcher ZachXBT posted about Revolut’s email to affected customers late on Friday. Notably, the researcher suggested that the incident appeared to have been targeted at high net worth users, indicating a carefully planned attack rather than a random data breach.

Revolut’s Global Footprint

London-based Revolut has grown into one of the world’s largest fintech platforms, with more than 80 million customers globally. The company operates as a bank in more than 30 countries, according to its website. Recently, the fintech has been aggressively expanding its presence in key markets including India, Mexico, France, and the UAE.

Furthermore, earlier this month, the U.S. Office of the Comptroller of the Currency granted conditional approval to Revolut to establish a national bank in the United States. The firm expects to launch this banking operation in the first half of 2027, marking a significant milestone in its American expansion strategy.

Implications for Upcoming IPO

The timing of this security incident is particularly sensitive for Revolut. The company reportedly weighs a potential public listing that could value it at as much as $200 billion, up significantly from its $75 billion private valuation in November.

Security breaches can have substantial impacts on investor confidence and regulatory scrutiny, especially for companies handling sensitive financial data. Consequently, how Revolut manages the fallout from this incident may influence its IPO timeline and valuation prospects.

In addition to its IPO preparations, the fintech has been steadily expanding its banking footprint across Europe and globally. The company has secured banking licenses in both France and the UK in recent months, demonstrating its commitment to becoming a fully regulated financial institution.

Sophisticated Social Engineering Attack

The method used in this breach highlights an increasingly sophisticated approach to social engineering attacks. Unlike traditional hacking methods that exploit technical vulnerabilities, this attack leveraged trust in legitimate government communications to deceive Revolut employees into releasing sensitive customer data.

Cybersecurity experts have long warned that email impersonation using compromised or spoofed government domains represents a serious threat to organizations. These attacks are particularly dangerous because employees are trained to respond promptly to official government requests, creating a vulnerability that bad actors can exploit.

The incident raises critical questions about verification procedures at financial institutions when responding to official-looking requests for customer information. As a result, many fintech companies may need to review and strengthen their protocols for authenticating government inquiries.

Customer Protection Measures

While Revolut has not publicly disclosed specific measures it will implement to prevent similar incidents, the company’s swift response suggests it takes the breach seriously. Affected customers should remain vigilant for potential phishing attempts or identity theft scams that could leverage the exposed information.

Security experts typically recommend that individuals whose data has been compromised in such breaches monitor their financial accounts closely. Furthermore, they should be wary of unexpected communications claiming to be from Revolut or government agencies, as criminals may attempt to exploit the situation for secondary attacks.

This incident serves as a stark reminder that even sophisticated fintech companies with robust security infrastructure remain vulnerable to well-crafted social engineering attacks. Consequently, the financial services industry as a whole may need to reassess how it verifies and responds to requests from government agencies and other official entities.