Revolut says a third party posing as a government agency tricked the company into disclosing some customers’ personal and financial data. The attacker used an email address on a legitimate government agency domain, causing the request to be treated as a real legal inquiry. Revolut says customer funds and internal systems were not affected, but impacted users are being notified.
Revolut disclosed that a third party impersonating a government agency tricked the company into disclosing personal and financial information belonging to a subset of customers. The attacker used an email address on a legitimate government agency domain to submit what appeared to be a formal legal inquiry. Because the request carried valid technical domain credentials, it was treated as an authentic agency inquiry rather than flagged as suspicious.
The scenario followed a common pattern for legal/law-enforcement pretext attacks:
Exposed data reportedly included names, addresses, phone numbers, dates of birth, occupation, copies of driver's licenses and passports, and verification selfies, along with financial details such as IBANs, account statements, withdrawal records, and full transaction history including Bitcoin activity.
This incident illustrates why domain-based trust is not sufficient on its own. Because the email originated from a legitimate government agency domain and carried valid technical credentials, it passed the checks that teams often use to judge authenticity. Email as a single validation channel, without a callback to a known number or confirmation through an official portal, left little room to catch the fraudulent nature of the request. The unusual breadth of the ask, spanning identity documents and complete transaction histories, is itself a red flag that can be missed when a request otherwise looks technically sound.
Teams that handle legal, compliance, and data requests should watch for:
Organizations can reduce exposure to this type of impersonation by treating emailed legal requests as high-risk by default and verifying them through an independent, trusted channel such as a known phone number or established point of contact. Limiting data disclosure to the minimum necessary, and applying added scrutiny when a request asks for full transaction history or identity documents, can also reduce the impact if a fraudulent request slips through initial review. Training legal, compliance, privacy, fraud, and customer support teams to recognize that a legitimate-looking domain does not guarantee a legitimate request is central to defending against this kind of social engineering.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An unauthorized third party used a legitimate government agency domain email to submit fraudulent data requests, which carried valid technical domain credentials and was treated as an authentic agency inquiry.
Exposed data reportedly included PII such as ID documents and verification selfies, along with financial history including transaction records and Bitcoin transactions.
Revolut says customer funds and internal systems were not affected, but a subset of users was impacted and is being notified.
The request relied solely on email as validation, with no independent callback or portal verification, and the legitimate-looking domain caused the request to be treated as authentic.
Revolut got tricked by an email that looked like it was from a real government agency, and customer data walked out the door. Someone posed as a government agency, used a legitimate government-domain email, and asked for IDs, selfies, and full transaction history. The request carried valid technical credentials, so it was treated as a real legal inquiry. Here’s the trap: everyone trusts the domain and the legal tone, but no one stops to verify the request anywhere else. No callback to a known number, no check in an official portal, just email in, data out. Your move: any emailed ‘legal’ or ‘government’ data request? Pause. Independently verify it using a known phone number or official portal you look up yourself, before you send a single record.
Revolut confirmed a breach after an attacker impersonated a government agency and sent fraudulent data requests from what appeared to be a legitimate government email domain. Employees processed the requests as normal legal-compliance work, leading to exposure of sensitive customer identity and…
Revolut disclosed it was deceived into sharing highly sensitive customer data after receiving fraudulent information requests that appeared to come from a legitimate government email domain. The attacker’s email passed domain authentication, making it harder to detect, and the shared data may…
Revolut confirmed that an attacker impersonated a government agency using an email address on that agency’s real domain to obtain sensitive customer records. Revolut says only a limited number of customers were affected and that customer funds and Revolut systems were not accessed.
Revolut says it handed over sensitive customer identity and financial data after receiving what looked like a legitimate government information request. The email came from inside a real government agency’s email domain and passed authentication checks, so staff processed it before later…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Revolut confirmed it disclosed sensitive customer information after fraudsters sent “emergency” information requests from a legitimate government email domain. The attackers appear to have targeted high-net-worth customers, including people involved in crypto, and attempted to extort Revolut to…
