Revolut confirms customer data breach through fake government requests

London-based fintech Revolut has confirmed that an unauthorized external party obtained customer information after submitting fraudulent requests from an email address using a legitimate government agency domain. The company told affected users by email and has taken steps to block the address used in the scam. According to the notification reviewed by TechCrunch, the exposed records included identity and contact details such as dates of birth, postal and email addresses, and phone numbers, as well as copies of identity documents including passports and driver’s licenses. Revolut said the data set may also have contained verification selfies, account statements, and transaction histories. A Revolut spokesperson described the incident as a sophisticated impersonation scam and said a limited number of customers were impacted, but the firm did not provide a precise count, identify the government agency whose domain was spoofed, or say whether the compromise was limited to a particular market. Security researcher ZachXBT posted about Revolut’s message and reported the incident appeared to target high-net-worth users. Revolut said it has alerted the relevant government agency, law enforcement, and financial regulators and emphasized that its systems and customer funds remain unaffected. The company operates globally with more than 80 million customers and banking operations in over 30 countries, and has recently expanded into markets including India, Mexico, France and the UAE while pursuing further regulatory approvals and potential growth initiatives.