Revolut confirmed a breach after an attacker impersonated a government agency and sent fraudulent data requests from what appeared to be a legitimate government email domain. Employees processed the requests as normal legal-compliance work, leading to exposure of sensitive customer identity and account information for a limited number of customers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this lands in your inbox: “Request for information, legal compliance. Please provide the requested customer records.” And it’s from a real government email domain. That’s exactly how Revolut was tricked. An unauthorized third party used a legitimate government agency domain with valid technical authentication, so the emails passed all the usual checks and were treated as standard legal work. Employees fulfilled the requests and sent over names, addresses, dates of birth, phone numbers, emails, ID documents, even transaction history. All because the sender domain looked right and the process felt routine. Your move: if an email claims to be a government or legal data request, stop. Don’t reply. Independently verify it using a phone number or portal you already trust before sending a single record.
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
A person posing as a government agency used an email address on that agency’s real domain to obtain sensitive customer records from Revolut. The same weekly roundup also describes a fake antivirus renewal web page impersonating Avast, telling victims their subscription renewed for €129.99 and…
Revolut confirmed a customer data breach after attackers used a compromised government agency domain to submit fake “official” requests for customer information. Revolut provided sensitive details (including IDs like passports and driver’s licenses) based on those email requests, raising questions…
Attackers used a compromised government email account to pose as authorities and request customer records from Revolut. Employees believed the requests were legitimate and voluntarily sent sensitive customer information, exposing data for nearly 700 people. The incident highlights how “trusted”…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
