Revolut confirmed a customer data breach after attackers used a compromised government agency domain to submit fake “official” requests for customer information. Revolut provided sensitive details (including IDs like passports and driver’s licenses) based on those email requests, raising questions about verification controls for law-enforcement or government inquiries.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Revolut actually handed over passports and IDs because a fake ‘government’ email asked for them. Attackers used a compromised government domain and wrote, 'Hello Revolut Compliance Team, we are requesting customer details in relation to an official government inquiry. Please provide the customer’s address, date of birth, and identity documentation.' And Revolut sent it. Here’s the trap: the domain looked official, but it was compromised. There was no secure portal, no signed warrant, no callback to a published number, just an email, and they still released addresses, birthdates, and ID scans. If an email asks for customer data in the name of ‘government’ or ‘law enforcement,’ stop. Don’t reply. Route it through our official legal intake channel and let them verify it.
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
A person posing as a government agency used an email address on that agency’s real domain to obtain sensitive customer records from Revolut. The same weekly roundup also describes a fake antivirus renewal web page impersonating Avast, telling victims their subscription renewed for €129.99 and…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Revolut confirmed a breach after an attacker impersonated a government agency and sent fraudulent data requests from what appeared to be a legitimate government email domain. Employees processed the requests as normal legal-compliance work, leading to exposure of sensitive customer identity and…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Attackers used a compromised government email account to pose as authorities and request customer records from Revolut. Employees believed the requests were legitimate and voluntarily sent sensitive customer information, exposing data for nearly 700 people. The incident highlights how “trusted”…
