Revolut says it disclosed sensitive customer information after receiving fraudulent information requests that appeared to come from a real government agency email domain. The company framed it as a sophisticated impersonation scam, not a technical break-in, showing how “legitimate-looking” requests can still be malicious when they ask for customer data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Revolut handed over customer data to a fraudster… and the email came from a real government domain. The message said, 'We are requesting sensitive customer information as part of an official government information request.' Because it looked authentic, Revolut sent IDs, selfies, statements, even transaction histories, to an unauthorized third party. Here’s the trap: the attacker didn’t hack Revolut’s systems. They exploited trust in a real government email domain. Even properly authenticated, legitimate-looking correspondence can be malicious when it asks for customer data. If an email asks for IDs, selfies, or statements, even from a government domain, stop and follow our official lawful-request process. One rule: no process, no data.
Revolut confirmed it shared sensitive customer information with an unauthorized party after accepting fraudulent “government” information requests sent from an email address on a legitimate government domain. The company says this was an external impersonation scam (not a system hack) and that…
Revolut disclosed it was deceived into sharing highly sensitive customer data after receiving fraudulent information requests that appeared to come from a legitimate government email domain. The attacker’s email passed domain authentication, making it harder to detect, and the shared data may…
Revolut confirmed that an attacker impersonated a government agency using an email address on that agency’s real domain to obtain sensitive customer records. Revolut says only a limited number of customers were affected and that customer funds and Revolut systems were not accessed.
Revolut says it handed over sensitive customer identity and financial data after receiving what looked like a legitimate government information request. The email came from inside a real government agency’s email domain and passed authentication checks, so staff processed it before later…
Revolut says a third party posing as a government agency tricked the company into disclosing some customers’ personal and financial data. The attacker used an email address on a legitimate government agency domain, causing the request to be treated as a real legal inquiry. Revolut says customer…
Revolut confirmed it disclosed sensitive customer information after fraudsters sent “emergency” information requests from a legitimate government email domain. The attackers appear to have targeted high-net-worth customers, including people involved in crypto, and attempted to extort Revolut to…
