Threat actors allegedly used a compromised Italian government PEC email account to impersonate law enforcement and send fraudulent information requests to Revolut. Revolut says its systems were not breached, but it received requests that appeared to come from a legitimate government domain and provided customer data in response. About 680 customers were reportedly affected, with exposed data including identity documents, banking details, and transaction history (including crypto).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Revolut wasn’t hacked. They were tricked by what looked like real Italian police emails from pec.interno.it. A compromised PEC mailbox, posing as Italian Postal Police, sent fake European Investigation Orders asking Revolut for IDs, account statements, even crypto transaction history for about 680 customers. Here’s the twist: the emails even CC’d a second official PEC address, making it look like normal government-to-government traffic, while asking for unusually broad data on lots of crypto-heavy accounts. If you ever see a law-enforcement or government email asking for large volumes of customer data, don’t just trust the domain, pause and trigger the out-of-band verification process before sending anything.
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Revolut disclosed it was deceived into sharing highly sensitive customer data after receiving fraudulent information requests that appeared to come from a legitimate government email domain. The attacker’s email passed domain authentication, making it harder to detect, and the shared data may…
Revolut confirmed that an attacker impersonated a government agency using an email address on that agency’s real domain to obtain sensitive customer records. Revolut says only a limited number of customers were affected and that customer funds and Revolut systems were not accessed.
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Attackers used a compromised government email account to pose as authorities and request customer records from Revolut. Employees believed the requests were legitimate and voluntarily sent sensitive customer information, exposing data for nearly 700 people. The incident highlights how “trusted”…
Revolut says a third party posing as a government agency tricked the company into disclosing some customers’ personal and financial data. The attacker used an email address on a legitimate government agency domain, causing the request to be treated as a real legal inquiry. Revolut says customer…
