Revolut says it handed over sensitive customer identity and financial data after receiving what looked like a legitimate government information request. The email came from inside a real government agency’s email domain and passed authentication checks, so staff processed it before later discovering it was fraudulent. The exposed data included ID documents, verification selfies, account statements (including IBAN), and transaction history including Bitcoin.
An attacker either created a rogue account within an official government agency's email domain or compromised an existing one, then used that account to submit what looked like a legitimate customer data request. Because the message carried valid domain authentication credentials, it passed automated authenticity checks and was processed under the reasonable belief that it was a genuine government request. Staff released a substantial data package in response, including identity documents, verification selfies, account statements with IBAN details, and full transaction history including Bitcoin.
The request exploited a gap between technical email authentication and actual authorization. Domain authentication confirms that a message originated from infrastructure tied to a domain, but it does not confirm that the specific sender or mailbox is authorized to make the request being made. Relying mainly on email authentication allowed an attacker with access to a government domain to bypass checks and obtain sensitive customer data without triggering a manual verification step before the data was sent.
Compliance, legal, AML/KYC operations, and fraud teams should treat valid domain authentication as necessary but not sufficient proof of a legitimate request. Before releasing customer data in response to a government or legal request, staff should independently verify the request through a known contact channel for the requesting agency, separate from the email that made the request. Unusually broad data requests, especially those combining identity documents, financial statements, and transaction histories, should be escalated for additional review rather than fulfilled on receipt. Building this verification step into standard procedure reduces the risk that a compromised or rogue account inside a trusted domain can be used to extract sensitive customer records.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The email carried valid domain authentication credentials because it was sent from an unauthorized mailbox within a real government agency's official domain, so it passed authenticity checks and was processed as a legitimate request.
The exposed data included identity and contact details, copies of passports and driver's licenses, verification selfies, account statements including IBAN, and full transaction histories including Bitcoin.
Revolut discovered the fraud only after independently contacting the government agency to verify the request, at which point the agency confirmed it had not made it.
A crypto security researcher assessed that the operation appeared to be targeted at high-net-worth users.
Revolut got a government email, checked the domain, it passed all the tests… and they still sent customer passports and Bitcoin history to a fraudster. The trick? The attacker used an unauthorized mailbox inside a real government email domain. It carried valid authentication, so staff believed it was a lawful request and handed over full KYC packs and transaction histories. Here’s the scary part: everything looked fine until Revolut later phoned the agency and heard, ‘We never sent that.’ By then, high‑net‑worth customers’ IDs, selfies, IBANs, and Bitcoin histories were already gone. Your move: if an email asks for a full KYC pack plus account or crypto history, stop. Independently call or portal‑message the supposed authority using a known number before you send a single file.
Revolut confirmed it shared sensitive customer information with an unauthorized party after accepting fraudulent “government” information requests sent from an email address on a legitimate government domain. The company says this was an external impersonation scam (not a system hack) and that…
Revolut confirmed that an attacker impersonated a government agency using an email address on that agency’s real domain to obtain sensitive customer records. Revolut says only a limited number of customers were affected and that customer funds and Revolut systems were not accessed.
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
A person posing as a government agency used an email address on that agency’s real domain to obtain sensitive customer records from Revolut. The same weekly roundup also describes a fake antivirus renewal web page impersonating Avast, telling victims their subscription renewed for €129.99 and…
Revolut confirmed a customer data breach after attackers used a compromised government agency domain to submit fake “official” requests for customer information. Revolut provided sensitive details (including IDs like passports and driver’s licenses) based on those email requests, raising questions…
Attackers used a compromised government email account to pose as authorities and request customer records from Revolut. Employees believed the requests were legitimate and voluntarily sent sensitive customer information, exposing data for nearly 700 people. The incident highlights how “trusted”…
