Revolut disclosed sensitive customer records to an unauthorized party after fraudulent data requests arrived from an email address on a legitimate government domain, the company confirmed on Saturday, September 12. The exposed material may include identity documents, verification selfies, account statements, and transaction histories containing Bitcoin activity.
Revolut told TechCrunch that a limited number of customers were affected and that its systems and customer funds remained unaffected. The incident raises privacy concerns because identity records and Bitcoin transaction histories may have been disclosed to an unauthorized party.
So what has happened? Someone impersonated a government agency using an address on that agency’s own domain, and the request cleared Revolut’s checks before it was identified as fraudulent. Customer information was disclosed during that period.
The notification Revolut emailed to affected customers listed birth dates, postal and email addresses, phone numbers, and copies of identity documents such as passports and driving licenses. Verification selfies, account statements, and transaction histories may also have been disclosed, the bank said.
Revolut said it blocked the sender’s address after detecting the scheme and alerted the government agency concerned, as well as law enforcement, data protection authorities, and financial regulators. A company spokesperson characterized the episode as an external impersonation scam and said the company’s systems and customer funds were unaffected.
Trade XRP on Bybit and Get a Chance to Win Our $1,000 USDT Airdrop
ZachXBT Flags Bitcoin Exposure
Crypto investigator ZachXBT publicized the notice in a Telegram post and added several items Revolut’s own notification did not list: IBANs, withdrawal records, occupations, and transaction history covering Bitcoin. He assessed the incident as limited in scale and aimed at high-net-worth users.
Revolut has not disclosed an exact number of affected customers. The company also has not stated that crypto holders or wealthy customers were specifically targeted, so the assessment of the apparent target group remains separate from Revolut’s primary disclosure.
Earn $50 and Enter $300K Prize Draw on EdgeX
What’s Next for Revolut Users?
Bitcoin’s blockchain records transactions publicly, while personal details such as a passport or home address sit outside the network. Financial intermediaries can connect those different types of information through the records they collect. This incident illustrates the privacy concern when identity documents are disclosed alongside Bitcoin transaction histories.
Information that includes names, addresses, contact details, and transaction histories can create a more detailed picture of an affected customer than any one category of data alone. The reporting does not document a follow-on misuse of the information in this incident, but it highlights the sensitivity of records that link personal information with financial activity.
Revolut’s response included blocking the sender, notifying regulators, and contacting affected customers directly. The episode also focuses attention on how financial institutions assess requests that appear to come from government agencies and on the scope of information released when those requests are accepted as legitimate.
For crypto users who use Revolut or similar platforms, the incident is a reminder that crypto privacy can depend on how intermediaries handle identity documents, account records, and transaction histories. Revolut said customer funds remained safe, while the disclosure shows that fraud involving an apparently legitimate government-domain email can still expose sensitive customer data.
Discover: The Best Token Presales
