Revolut Confirms Customer Data Exposure Following Fraudulent Government Requests

Revolut has confirmed that sensitive customer information was disclosed to an unauthorized third party following a sophisticated external impersonation scheme.

According to the company, the attacker used an email address associated with a legitimate government agency domain to submit fraudulent requests for customer information. Because the communications appeared to originate from an authentic government source, certain customer data was disclosed before the fraudulent activity was identified.

What Information May Have Been Exposed?

The information involved may have varied between affected customers. Reported categories of data include full names and contact details, dates of birth, residential addresses, email addresses, phone numbers, and copies of passports or driver's licenses.

According to reports, some affected customer records may also have included verification selfies, bank statements, or transaction history. Revolut has stated that only a limited number of customers were affected.

Revolut's Response

Revolut has said that its internal systems were not compromised and that customer funds were not affected. The company also stated that the fraudulent email address has been blocked and that the incident has been reported to the relevant authorities and regulators.

Why This Matters for International Businesses

This incident highlights an important reality: even leading financial institutions can become targets of sophisticated social engineering attacks. Fraudulent requests that appear to come from trusted government sources can create serious risks for any organization that handles sensitive identity, compliance, or financial documentation.

For businesses operating internationally, protecting corporate records and KYC documentation is just as important as company formation, regulatory compliance, or opening a corporate bank account. Secure document handling, careful verification procedures, and clear internal controls are essential parts of modern international business.

Companies that collect or submit sensitive documents should regularly review how information requests are verified, who is authorized to release client or corporate data, and how unusual requests are escalated before any documents are shared.