Revolut acknowledges exposure of passport and transaction data of some clients

British fintech Revolut has confirmed the exposure of confidential information of some customers after a third party sent fraudulent data requests to the company from an email address on the domain of a real government body.

The incident was reported by TechCrunch, citing a Revolut representative and messages the company sent to affected users. Revolut called the event "a sophisticated external impersonation scheme".

According to the company, the attacker used an email address on a legitimate government agency domain to send false requests for customer information. Revolut did not disclose which government body was used in the scheme.

Among the data that could have been shared with a third party are customer names, dates of birth, postal and email addresses, phone numbers, and copies of identity documents, including passports and driver's licenses. Selfies taken for identity verification, account statements, and transaction history could also have been exposed.

The Block clarifies that messages to individual affected customers also mentioned possible exposure of IBAN, cash withdrawal data, and complete transaction history, including Bitcoin transactions.

Revolut stated that the incident affected a "limited" number of customers, who have been informed directly. The fintech did not disclose the exact number of affected users or whether they were concentrated in a particular country or region.

After discovering the scheme, Revolut blocked the email address from which the fraudulent requests were sent and notified the relevant government body, law enforcement, data protection authorities, and financial regulators.

The company emphasized that its internal systems were not compromised and customer funds were not affected by the incident. That is, it was not a direct intrusion into Revolut's infrastructure, but the acquisition of information through forged requests that appeared to be official inquiries from a government agency.

Based on materials from: TechCrunch, The Block