Skip to content
OriginalSign in
Image: Malwarebytes

Malwarebytes

Revolut Customers Targeted by Phishing Days After Data Breach

Part of the Revolut story · since 6 Sep

Quiet for 6 weekslast report 21 Sep13 articles6 outlets
6 Sep · DataBreaches first6 Oct16 OctNowThis article11th of 13
  • Sun 6 Sep, 11:46 UTC. DataBreaches, first report. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks.
  • Sat 12 Sep, 21:57 UTC. Security Affairs, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Request.
  • Mon 14 Sep, 09:36 UTC. SecurityOnline, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Requests.
  • Mon 14 Sep, 11:57 UTC. Infosecurity, its first report on the story. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests.
  • Mon 14 Sep, 11:57 UTC. Malwarebytes, its first report on the story. Revolut Exposed Customer Data After Government Email Scam.
  • Mon 14 Sep, 13:41 UTC. SecurityWeek, its first report on the story. Revolut Exposes Customer Data After Impersonated Agency Request.
  • Tue 15 Sep, 12:00 UTC. DataBreaches. Revolut Confirms Data Breach After Government Email Impersonation.
  • Tue 15 Sep, 12:35 UTC. DataBreaches. Revolut Reportedly Shared Biometric Data After Fake Government Request.
  • Wed 16 Sep, 14:16 UTC. Security Affairs. Italian Government Email Hack Exposes Data on 680 Revolut Users.
  • Thu 17 Sep, 14:11 UTC. SecurityWeek. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data.
  • Thu 17 Sep, 14:48 UTC. Malwarebytes. Revolut Customers Targeted by Phishing Days After Data Breach. This article, 11th of 13.
  • Mon 21 Sep, 07:30 UTC. Malwarebytes. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs.
  • Mon 21 Sep, 09:13 UTC. Infosecurity. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks.

Revolut customers began receiving phishing texts days after the digital bank acknowledged that sensitive customer records had been disclosed to an unauthorised party. Revolut had accepted fraudulent information requests sent from an email address on a legitimate government-agency domain, exposing a limited or “very limited” number of customers.

The data reportedly included dates of birth, addresses, email addresses, phone numbers, copies of passports or driving licences, verification selfies, account statements and transaction histories. Revolut said it had contacted affected customers directly.

Malwarebytes said one affected customer received a message on 14 September, two days after the breach was publicly acknowledged. The text appeared in the same conversation as genuine Revolut messages, making it look authentic; VirusTotal records show the linked phishing domain was first scanned that day. In another reported case, the link requested camera access and displayed a fake version of Revolut’s “turn your head” live-video identity check before asking for a password.

The campaign could harvest selfies or video and credentials for further social engineering, identity fraud or account takeover. However, Malwarebytes said it could not confirm whether the texts used information from the breach or were opportunistic scams exploiting the news.

Customers should avoid links in unexpected account messages and open the official Revolut app directly instead. They should also check the destination domain carefully before entering information.

How the story developed

All 13 articles
Quiet for 6 weekslast report 21 Sep13 articles6 outlets

13 articles from 6 outlets since 6 Sep. Quiet since 21 Sep. This was the 11th report, 11 days after the first.

Now6 Sep910121416182022First reportDataBreaches · 6 Sep, 11:46This article11th of 13 · day 11Picked up againafter 6 days quiet
  • Sun 6 Sep, 11:46 UTC. DataBreaches, first report. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks.
  • Sat 12 Sep, 21:57 UTC. Security Affairs, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Request.
  • Mon 14 Sep, 09:36 UTC. SecurityOnline, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Requests.
  • Mon 14 Sep, 11:57 UTC. Infosecurity, its first report on the story. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests.
  • Mon 14 Sep, 11:57 UTC. Malwarebytes, its first report on the story. Revolut Exposed Customer Data After Government Email Scam.
  • Mon 14 Sep, 13:41 UTC. SecurityWeek, its first report on the story. Revolut Exposes Customer Data After Impersonated Agency Request.
  • Tue 15 Sep, 12:00 UTC. DataBreaches. Revolut Confirms Data Breach After Government Email Impersonation.
  • Tue 15 Sep, 12:35 UTC. DataBreaches. Revolut Reportedly Shared Biometric Data After Fake Government Request.
  • Wed 16 Sep, 14:16 UTC. Security Affairs. Italian Government Email Hack Exposes Data on 680 Revolut Users.
  • Thu 17 Sep, 14:11 UTC. SecurityWeek. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data.
  • Thu 17 Sep, 14:48 UTC. Malwarebytes. Revolut Customers Targeted by Phishing Days After Data Breach. This article, 11th of 13.
  • Mon 21 Sep, 07:30 UTC. Malwarebytes. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs.
  • Mon 21 Sep, 09:13 UTC. Infosecurity. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Sun 6 SepDay 01
    1. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks11:46 · DataBreaches · First report

  2. Quiet for 6 days

    Sat 12 SepDay 61
    1. Revolut Exposed Customer Data After Fraudulent Government Request21:57 · Security Affairs · Picked up again
  3. Mon 14 SepDay 84
    1. Revolut Exposed Customer Data After Fraudulent Government Requests09:36 · SecurityOnline
    2. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests11:57 · Infosecurity
    3. Revolut Exposed Customer Data After Government Email Scam11:57 · Malwarebytes
    4. Revolut Exposes Customer Data After Impersonated Agency Request13:41 · SecurityWeek
  4. Tue 15 SepDay 92
    1. Revolut Confirms Data Breach After Government Email Impersonation12:00 · DataBreaches
    2. Revolut Reportedly Shared Biometric Data After Fake Government Request12:35 · DataBreaches
  5. Wed 16 SepDay 101
    1. Italian Government Email Hack Exposes Data on 680 Revolut Users14:16 · Security Affairs
  6. Thu 17 SepDay 112
    1. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data14:11 · SecurityWeek
    2. Revolut Customers Targeted by Phishing Days After Data Breach14:48 · Malwarebytes · This article, 11th of 13

  7. Quiet for 4 days

    Mon 21 SepDay 152
    1. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs07:30 · Malwarebytes · Picked up again
    2. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks09:13 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in