In a recent and unsettling episode, the digital banking service Revolut found itself at the center of a privacy breach that exposed a range of sensitive personal data, including passport details, selfie photographs, and home addresses. The incident unfolded when the company received a request that appeared to be an official government directive, but was in fact a cleverly fabricated fraud. Believing the request to be legitimate, Revolut complied, handing over the requested information to the perpetrators. While the breach did not result in any direct loss of customer money, the exposure of personal identification documents and location data raises serious concerns about the robustness of verification procedures employed by fintech firms and the potential for similar attacks in the future.
The saga began when Revolut’s compliance team received a communication that bore the hallmarks of a formal government order. The document referenced a legal framework that purportedly gave authorities the right to access certain user data for investigative purposes. It specifically demanded a list of Bitcoin-related activity, alongside copies of customers’ passports, selfie images used for identity verification, and the residential addresses linked to each account. The request was framed in a manner that mimicked official language, complete with a faux government seal and a signature that appeared authentic at first glance.
Faced with what seemed to be a lawful request, Revolut’s internal processes moved forward. The compliance department, tasked with ensuring the company meets legal obligations, verified the request against its standard checklist. Unfortunately, the verification steps were insufficient to detect the forgery. The request passed the internal audit, and the data was compiled and transmitted to the entity that had sent the original message.
Only after the data had already been handed over did the company realize that the request was not from a genuine governmental body. The data disclosed included a substantial amount of personally identifying information (PII). Passports, which contain birth dates, nationalities, and unique passport numbers, were shared.
In addition, selfie photographs—used by Revolut during the onboarding process to confirm that the individual presenting the ID matched the person opening the account—were also transferred. These images, combined with home address details, create a comprehensive profile that could be exploited for identity theft, fraud, or targeted phishing attacks.
Moreover, the request also sought details about Bitcoin transactions, a particularly sensitive area given the pseudonymous nature of cryptocurrency and the heightened regulatory scrutiny surrounding it. Fortunately, the breach did not involve any direct theft of funds from customers’ accounts. Revolut’s internal security measures prevented unauthorized withdrawals, and the company’s financial safeguards remained intact.
However, the incident underscores a different kind of vulnerability: the exposure of data that can be leveraged to compromise an individual's identity and privacy. In response to the breach, Revolut issued a public statement acknowledging the mistake and outlining the steps it would take to prevent a recurrence. The company emphasized that it had launched an internal investigation to pinpoint the exact failure points in its verification workflow. It also pledged to enhance its authentication mechanisms for government requests, including the implementation of multi‑factor verification, direct liaison with official agencies, and the use of cryptographic signatures to confirm the authenticity of such orders.
Experts in data security and regulatory compliance have weighed in on the incident, highlighting several lessons for the broader fintech industry. First, the reliance on visual cues—such as seals and signatures—without corroborating the request through independent channels can be a dangerous shortcut.
Second, the growing sophistication of social engineering attacks means that organizations must adopt a zero‑trust mindset, treating every external request as potentially malicious until proven otherwise. Third, the incident illustrates the need for clear, industry‑wide standards for how financial institutions handle government data requests, especially when they intersect with cryptocurrency activity, which often falls into a regulatory gray area.
Customers affected by the breach have been notified and offered complimentary credit monitoring services, a standard practice aimed at mitigating the risk of identity theft. Revolut has also set up a dedicated help line for users who have questions or concerns about the data that may have been shared. While the company assures that no monetary loss has occurred, it acknowledges that the psychological impact of having one’s personal documents exposed can be significant. The broader implications of this event extend beyond Revolut.
As digital banks continue to expand their user bases and incorporate services such as cryptocurrency trading, they become increasingly attractive targets for fraudsters seeking to exploit procedural gaps. Regulators are likely to scrutinize this incident closely, potentially prompting new guidelines that require more stringent verification of law‑enforcement requests, especially those involving high‑value or privacy‑sensitive data.
In summary, Revolut’s inadvertent compliance with a counterfeit government request resulted in the disclosure of passport information, selfie verification images, and residential addresses, alongside details of Bitcoin transactions. Although no funds were stolen, the breach serves as a stark reminder of the importance of rigorous verification processes, robust data protection practices, and the need for ongoing vigilance against increasingly sophisticated social engineering attacks.
The incident has spurred Revolut to overhaul its compliance checks, provide affected customers with protective services, and engage with regulators to shape stronger safeguards for the future. The episode stands as a cautionary tale for all digital financial service providers: the line between legitimate authority and malicious impersonation can be thin, and the cost of a misstep is measured not just in dollars, but in the trust and privacy of millions of users.