Revolut confirmed that an attacker impersonated a government agency using an email address on that agency’s real domain to obtain sensitive customer records. Revolut says only a limited number of customers were affected and that customer funds and Revolut systems were not accessed.
An attacker impersonated a government agency by using an email address on that agency's real domain. This gave the request an appearance of legitimacy that likely bypassed the usual skepticism reserved for external inquiries. Using this pretext, the attacker requested customer records from Revolut, framing it as an official regulatory or law enforcement inquiry that required urgent action.
According to Revolut, the data exposed to the attacker included contact details, dates of birth, and copies of identity documents such as passports and driving licences. Verification selfies, account statements, and transaction histories may also have been included. A third party separately claimed that additional fields, such as IBANs and bitcoin transaction history, were exposed, and assessed the targeting as focused on high-net-worth users.
The core weakness exploited here was trust in domain-level legitimacy. Because the request came from an address on the agency's actual domain, staff handling the inquiry had reduced reason to suspect impersonation through typical technical indicators like spoofed domains or lookalike addresses. Combined with urgency and the appearance of an official process, this created pressure to respond quickly rather than pause for independent verification.
The request also asked for a broad scope of sensitive data, including identity documents and financial details, well beyond what a routine or narrowly scoped inquiry might need. Without a step to confirm the request through a secondary, trusted channel, this broad ask was fulfilled.
Organizations handling sensitive customer data should treat any request, even one from an apparently legitimate government domain, as unverified until confirmed through an independent channel such as a known phone number or official portal. Data sharing should follow a minimum-necessary principle: identity documents, statements, and transaction histories should only be sent when a request is fully validated and clearly requires that scope.
Compliance, legal, and privacy teams should have a fast internal escalation path for external data requests, along with a clear process to block and report suspicious senders immediately. Revolut said it blocked the sender's address upon detecting the scheme and notified the relevant government agency, law enforcement, data protection authorities, and financial regulators, illustrating the kind of rapid response and multi-party reporting that limits further exposure once impersonation is identified.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An attacker impersonated a government agency using an email address on that agency's actual domain, and used this to request and obtain sensitive customer records from Revolut.
Revolut told affected customers that exposed data included contact details, dates of birth, and copies of identity documents, with financial identifiers and transaction details possibly also included.
No, Revolut stated that its systems and customer funds were not accessed or compromised in this incident.
Treat data requests from government-looking domains as untrusted until verified through an independent channel, apply minimum-necessary data sharing, and maintain a fast escalation path for suspicious requests.
Imagine this lands in your inbox: “Urgent request for customer records – official government inquiry.” That’s exactly how Revolut got tricked. Someone impersonated a government agency, used an email on that agency’s real domain, and got Revolut to hand over customer records, IDs, contact details, even transaction history for some high‑net‑worth users. Here’s the trap: it felt routine, regulator asking for info, but the red flags were there: unexpected urgency, a demand for broad data like identity documents and full transaction histories, and everything handled over plain email. If any “government” email asks for customer records, stop and escalate it to Compliance or Legal using our internal process, do not send a single file back by email.
Revolut says it handed over sensitive customer identity and financial data after receiving what looked like a legitimate government information request. The email came from inside a real government agency’s email domain and passed authentication checks, so staff processed it before later…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
Victims say they downloaded a fake “Sparrow Wallet” app from Apple’s App Store that impersonated a legitimate desktop-only crypto wallet. The app tricked users into entering their wallet recovery phrase, then criminals used it to drain about $1.8 million in Bitcoin. The case highlights how…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
The article describes real-world social engineering aimed at both consumers and financial firms, including phone-based attacks on hedge funds and a turnkey scam kit that impersonates Tesla to steal cryptocurrency. The kit uses a professional-looking fake presale website with urgency tactics…
This weekly roundup includes real-world social engineering campaigns, including scammers mailing fake IRS letters to cryptocurrency holders and a phishing campaign impersonating Bank of America. The lures are designed to pressure victims into visiting a bogus compliance portal or installing remote…
