British fintech Revolut has admitted handing over sensitive customer data, including passports, verification selfies and full transaction histories, after falling for fraudulent information requests sent from a legitimate government agency's email domain. The company says it confirmed the attack, blocked the address and notified the "limited number" of affected customers.
Revolut told media it had "recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information." According to reporting by TechCrunch and the Financial Times, the attackers compromised an official Italian government email account on the PEC (Posta Elettronica Certificata) system — Italy's certified-mail channel for legal correspondence — and used it to submit requests that looked like legitimate law enforcement demands. Because the emails carried valid domain authentication, including SPF, DKIM and DMARC checks, Revolut's compliance team processed them as authentic official requests.
The data handed over was extensive. Customer notices circulated online listed full names, dates of birth, occupations, home and email addresses and telephone numbers, copies of passports and driver's licences, the verification selfies customers submitted when opening their accounts, IBANs, account statements, withdrawal logs and complete transaction histories — including bitcoin activity. Former Mt. Gox chief Mark Karpelès, who shared his notice publicly, said he was affected. The attackers told the Financial Times they had posed as Italian law enforcement and used blockchain analysis to pick out Revolut customers with large cryptocurrency holdings; crypto sleuth ZachXBT said the incident appeared aimed at high-net-worth users.
Revolut said that on detection it blocked the address and alerted the government agency, enforcement agencies and financial regulators, and that it contacted the "limited number" of impacted individuals directly to inform them and provide support. "Revolut systems and customer funds are unaffected," the company said. The incident drew criticism of the compliance pipeline itself: blockchain figure Marc Zeller wrote that KYC "hasn't produced meaningful upside and has put many in harm's way," while identity experts called it a process vulnerability — a trusted channel that was never subjected to zero-trust verification.
The episode feeds into wider fears about "wrench attacks", where leaked financial data helps criminals physically target wealthy crypto holders; hardware wallet maker Trezor disclosed structurally similar problems around the same period. Revolut has not said how many customers were affected or exactly how it detected the fraud. For the fintech, which built its brand on being a digital-native bank, the incident is a bruising test of whether its compliance machinery is as sophisticated as its product — and of what happens when the channel itself is the attack vector.