A person posing as a government agency used an email address on that agency’s real domain to obtain sensitive customer records from Revolut. The same weekly roundup also describes a fake antivirus renewal web page impersonating Avast, telling victims their subscription renewed for €129.99 and prompting them to act.
A person impersonating a government agency used an email address on that agency's real domain to request sensitive customer records. Because the email came from an authentic domain, it carried the appearance of legitimacy, and Revolut confirmed the incident. This case illustrates how domain-level authenticity can be misused: owning or accessing a real government email address is enough to make a request look credible, even when the actual sender has no authorization to make it.
The request relied on implied authority rather than a verified process. Customer support, compliance, and fraud teams are trained to respond to legitimate government inquiries, and an email from a real agency domain short-circuits the usual skepticism. Without a separate verification step, such as calling a published agency contact or checking an internal escalation list, a convincing domain and an authoritative tone can be enough to move sensitive data.
A related example from the same period shows a different but connected pattern: a fake Avast renewal page told visitors their subscription had renewed for €129.99 and would renew again in February. Researchers noted the page was more polished than typical scam sites, suggesting AI tools are helping less skilled scammers build convincing fakes. Both cases show that visual or domain-level polish is not a reliable signal of legitimacy.
Organizations handling customer data, especially in banking and fintech, should require independent verification for any external request involving sensitive records, regardless of how authoritative the sender domain appears. This means confirming requests through officially published contact channels rather than replying to the original email.
Employees across all teams should also be trained to treat unexpected renewal or billing messages with the same skepticism, using vendor contact information they look up themselves rather than links or numbers provided in the message. Building this habit into standard workflows, rather than relying on individual judgment in the moment, reduces the chance that a well-crafted impersonation attempt succeeds. As scam pages become more polished with the help of AI tools, verification processes matter more than visual trust signals.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Someone impersonating a government agency used an email address on that agency's actual domain to request and obtain sensitive customer records from Revolut.
Using a real domain does not prove the sender is authorized to act for that agency, since domain trust alone was relied on instead of a verified request process.
A fake Avast renewal page told visitors their subscription had renewed for €129.99 and would renew again in February, pressuring them to act quickly.
Verify the request through an official, independently looked-up channel rather than replying directly to the email or trusting the sender domain alone.
Someone used a real government email domain to trick Revolut into handing over sensitive customer records. The email looked official, came from that agency’s real domain, and asked for customer records. Revolut confirmed on September twelfth that they sent data based only on that email. Same playbook on the web: a polished fake Avast page says your Avast Premium Security just renewed for €129.99, covers five devices, and will renew again in February, pushing you to click or call fast. Here’s the move: if any email or web page asks for data or money, ignore the link and start your own contact, use our official process or the vendor’s site you look up yourself.
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
Scammers are setting up fake Fortnite “rewards,” “locker value,” and “competition” websites that funnel players to a fake Epic Games login page. The sites trick people into signing in so attackers can steal Epic usernames and passwords, then take over accounts for resale, fraud, or further scams. A…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
Researchers found a realistic-looking fake Avast renewal page that claims a subscription renewed for €129.99 and pushes victims to “cancel” by entering their name, email, and mobile number. The charge is fake, and the real goal is to collect contact details so scammers can follow up with a phone…
