Revolut Exposed Customer Data After Government Email Scam

Revolut has acknowledged disclosing sensitive customer records to an unauthorised party after accepting fraudulent information requests sent from an email address on a legitimate government agency domain, according to reports cited by Malwarebytes. The London-based financial platform, which says it has more than 80 million customers globally, described the incident as an external impersonation scam rather than an intrusion into its systems. It said customer funds were not affected, but did not identify the agency or reveal the email domain involved.

The attacker appears to have exploited the trust associated with the genuine government domain to obtain customer information through social engineering. The data potentially included dates of birth, postal addresses, email addresses, phone numbers, passport or driving-licence copies, verification selfies, account statements and transaction histories.

Revolut said a “limited” or “very limited” number of customers were affected, and that it had blocked the sending address, notified the relevant government agency, law-enforcement bodies, data-protection authorities and financial regulators, and contacted affected customers or would do so. Those notifications specify which data was disclosed.

The likely risk is follow-up fraud or identity theft rather than immediate unauthorised transfers. Affected customers should treat unexpected calls, emails, WhatsApp messages or texts claiming to secure an account, reverse a transfer or replace documents as suspicious, avoid supplied links and phone numbers, and contact Revolut through its official channels.

They should also review balances, cards, beneficiaries, transfers, statements and linked devices, and report unfamiliar activity through Revolut’s secure in-app chat.