Revolut Confirms Customer Data Breach Tied to Fake Government Requests

Revolut confirmed that sensitive customer information was disclosed to an unauthorized third party after the company received fraudulent requests from a legitimate government agency email domain. The company said it notified affected customers directly and alerted the relevant government agency, law enforcement, and financial regulators. Revolut described the incident as a sophisticated external impersonation scam.

The exposed information included identity and contact details such as birth date, postal address, email address, and phone number. According to the customer notification reviewed by TechCrunch, copies of identity documents including passports and driver’s licenses were also included. Revolut said the data may also have included verification selfies, account statements, and transaction histories.

A Revolut spokesperson told TechCrunch that a “limited” number of customers were impacted, but the company did not disclose the exact number. Revolut also did not say whether the incident was limited to a specific market or identify the government agency involved. The company said it blocked the email address after discovering the scam and added that Revolut systems and customer funds are unaffected.

The breach comes as Revolut continues to expand its banking footprint in Europe and globally. TechCrunch reported that Revolut has more than 80 million customers globally and operates as a bank in more than 30 countries, per its website. The company has recently expanded in markets including India, Mexico, France, and the UAE, while also receiving conditional approval from the U.S. Office of the Comptroller of the Currency to set up a national bank in the country.