Revolut handed over passports to a rogue account inside a real government domain

Revolut confirmed on September 12, 2026 that it disclosed sensitive customer data to an unauthorized third party after receiving fraudulent information requests sent from an email address operating inside an actual government agency's domain infrastructure, as reported by TechCrunch.

Revolut's customer notification, which began circulating on September 11, stated that the communication carried valid domain authentication credentials, meaning the email passed the checks that are supposed to confirm a message genuinely comes from a government authority.

The exposed data included customers' identity and contact details, including birth date, postal and email addresses and phone numbers, as well as copies of identity documents including passports and driver's licenses, according to a notification emailed to affected customers and reviewed by TechCrunch.

Multiple outlets including CoinDesk and Crypto Times confirm the transaction histories covered Bitcoin.

Crypto security researcher ZachXBT, who posted about Revolut's notification to affected customers, assessed that the incident appeared to be targeted at high-net-worth users.

Revolut said the incident impacted a limited number of customers and that it immediately contacted them, but did not disclose the scope of the incident.

Revolut declined to name the government agency involved or specify whether the breach affected a particular country or market.

Revolut says it blocked the email address, alerted the government agency involved, notified law enforcement, and reported the incident to financial regulators.

No systems were compromised, no malware was used, and Revolut's servers were not accessed by an outsider; Revolut also says its systems and customer funds were not affected.

Revolut recently won conditional U.S. approval to become a national bank, is reportedly considering a $200 billion IPO, and serves 80 million customers worldwide.

The attacker either created a rogue account within an official government agency's domain or compromised an existing one, then used that account to submit what appeared to be a legitimate data request, which Revolut staff processed.

Security Affairs notes that naming the agency would allow other regulated platforms to search their own legal-request logs for messages from the same mailbox, and that the silence on that point is a gap in the public record for other fintechs that may have received similar requests.

The domain authentication checks passed because the sending account was genuinely inside the agency's mail domain, so the control confirmed the origin domain rather than the sender's authority to make the request.

The notification reached customers one day before the publicly reported confirmation: September 11 to September 12, 2026.

Any firm that fulfils agency data requests received by email is reachable by the same account, because message headers cannot distinguish an authorised sender from an unauthorised one within the same domain.

Revolut only discovered the fraud afterward, by independently contacting the government agency to verify the request, at which point the agency confirmed it had not made it.

The independent verification call that revealed the fraud after fulfilment would have revealed it before fulfilment, since the agency confirmed on that call that it had never made the request.