Revolut says a third party posing as a government agency tricked the company into disclosing some customers’ personal and financial data. The attacker used an email address on a legitimate government agency domain, causing the request to be treated as a real legal inquiry. Revolut says customer funds and internal systems were not affected, but impacted users are being notified.
Revolut disclosed that a third party impersonating a government agency tricked the company into disclosing personal and financial information belonging to a subset of customers. The attacker used an email address on a legitimate government agency domain to submit what appeared to be a formal legal inquiry. Because the request carried valid technical domain credentials, it was treated as an authentic agency inquiry rather than flagged as suspicious.
The scenario followed a common pattern for legal/law-enforcement pretext attacks:
Exposed data reportedly included names, addresses, phone numbers, dates of birth, occupation, copies of driver's licenses and passports, and verification selfies, along with financial details such as IBANs, account statements, withdrawal records, and full transaction history including Bitcoin activity.
This incident illustrates why domain-based trust is not sufficient on its own. Because the email originated from a legitimate government agency domain and carried valid technical credentials, it passed the checks that teams often use to judge authenticity. Email as a single validation channel, without a callback to a known number or confirmation through an official portal, left little room to catch the fraudulent nature of the request. The unusual breadth of the ask, spanning identity documents and complete transaction histories, is itself a red flag that can be missed when a request otherwise looks technically sound.
Teams that handle legal, compliance, and data requests should watch for:
Organizations can reduce exposure to this type of impersonation by treating emailed legal requests as high-risk by default and verifying them through an independent, trusted channel such as a known phone number or established point of contact. Limiting data disclosure to the minimum necessary, and applying added scrutiny when a request asks for full transaction history or identity documents, can also reduce the impact if a fraudulent request slips through initial review. Training legal, compliance, privacy, fraud, and customer support teams to recognize that a legitimate-looking domain does not guarantee a legitimate request is central to defending against this kind of social engineering.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An unauthorized third party used a legitimate government agency domain email to submit fraudulent data requests, which carried valid technical domain credentials and was treated as an authentic agency inquiry.
Exposed data reportedly included PII such as ID documents and verification selfies, along with financial history including transaction records and Bitcoin transactions.
Revolut says customer funds and internal systems were not affected, but a subset of users was impacted and is being notified.
The request relied solely on email as validation, with no independent callback or portal verification, and the legitimate-looking domain caused the request to be treated as authentic.
Revolut got tricked by an email that looked like it was from a real government agency, and customer data walked out the door. Someone posed as a government agency, used a legitimate government-domain email, and asked for IDs, selfies, and full transaction history. The request carried valid technical credentials, so it was treated as a real legal inquiry. Here’s the trap: everyone trusts the domain and the legal tone, but no one stops to verify the request anywhere else. No callback to a known number, no check in an official portal, just email in, data out. Your move: any emailed ‘legal’ or ‘government’ data request? Pause. Independently verify it using a known phone number or official portal you look up yourself, before you send a single record.
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
A person posing as a government agency used an email address on that agency’s real domain to obtain sensitive customer records from Revolut. The same weekly roundup also describes a fake antivirus renewal web page impersonating Avast, telling victims their subscription renewed for €129.99 and…
Revolut confirmed a customer data breach after attackers used a compromised government agency domain to submit fake “official” requests for customer information. Revolut provided sensitive details (including IDs like passports and driver’s licenses) based on those email requests, raising questions…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Attackers allegedly stole Revolut customer data by sending fraudulent “government” legal requests for roughly five months. The requests appeared legitimate because they came from a compromised government employee email account, leading Revolut to comply and disclose sensitive personal and financial…
Threat actors allegedly used a compromised Italian government PEC email account to impersonate law enforcement and send fraudulent information requests to Revolut. Revolut says its systems were not breached, but it received requests that appeared to come from a legitimate government domain and…
