British fintech company Revolut has revealed that it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent requests sent from an email domain belonging to a legitimate government agency. The compromised data included customers' identity and contact details such as birth dates, postal and email addresses, phone numbers, and copies of identity documents like passports and driver’s licenses. Additional information potentially exposed included verification selfies, account statements, and transaction histories.
Revolut confirmed that only a limited number of customers were affected and that those impacted have been contacted directly. The company did not specify the exact number of individuals involved, nor did it disclose whether the breach was confined to a particular market or identify the government agency whose domain was impersonated.
A spokesperson for Revolut described the incident as a sophisticated external impersonation scam, where an unauthorized party exploited a legitimate government agency email domain to submit fraudulent information requests. Upon discovering the scam, Revolut blocked the fraudulent email address and notified the relevant government agency, law enforcement, and regulatory bodies. The company emphasized that its systems and customer funds remain secure.
Revolut, headquartered in London, serves over 80 million customers worldwide and operates as a bank in more than 30 countries. The fintech has recently expanded into markets including India, Mexico, France, and the UAE. It also received conditional approval from the U.S. Office of the Comptroller of the Currency to establish a national bank in the United States, expected to launch by mid-2027.
Security researcher ZachXBT noted that the breach appeared to target high net worth users, highlighting the potential risk to more valuable accounts. This incident comes as Revolut considers a public listing that could value the company at up to $200 billion, a significant increase from its $75 billion private valuation last November. The fintech has also been actively expanding its banking licenses across Europe and globally in recent months.