Bitcoin Transactions and Passport Data Leaked After Revolut Succumbs to Bogus Government Request

In a startling episode that underscores the growing pains of the digital‑banking sector, Revolut found itself at the center of a privacy breach after it complied with what turned out to be a counterfeit request purporting to come from a government authority. The incident, which has been widely reported in the fintech press, involved the inadvertent disclosure of highly sensitive personal data—including passport numbers, selfie photographs used for identity verification, and home addresses—of a number of Revolut customers. While the breach did not result in any direct theft of funds, the exposure of such personal identifiers raises serious concerns about the robustness of verification processes and the potential for identity‑theft exploitation. ## How the Incident Unfolded According to the investigation conducted by Revolus's internal security team, the chain of events began when the compliance department received an electronic communication that appeared to be an official request from a governmental agency.

The request was formatted in a manner that mimicked the typical language and branding used by legitimate authorities, including references to legal statutes and a deadline for response. The document asked Revolut to provide a list of customers who had engaged in Bitcoin‑related activity, along with accompanying identification documents such as scanned passports, selfie‑based facial verification images, and residential address details.

Because Revolut operates under a stringent “Know Your Customer” (KYC) regime, the company routinely processes and stores the aforementioned documents for regulatory compliance. However, the internal checks that should have flagged the request as suspicious—such as verification of the sender’s email domain, cross‑checking of official reference numbers, and a secondary confirmation call—were either bypassed or inadequately performed. As a result, the compliance team treated the request as legitimate and complied by transmitting the requested data to the alleged governmental entity.

## The Scope of the Data Exposed The data set that was handed over comprised: * **Passport numbers and scans** – These included the machine‑readable zone (MRZ) that contains personal identifiers and nationality information. * **Selfie photographs** – Used by Revolut’s automated identity verification system to match a user’s face with the passport photo. * **Home addresses** – The residential information that customers provide when opening an account, which is also used for anti‑money‑laundering (AML) monitoring.

* **Bitcoin transaction metadata** – Details about the volume and frequency of cryptocurrency transactions, though not the private keys or wallet balances themselves. Although the breach did not involve the transfer of any monetary assets, the combination of these data points creates a potent profile that could be leveraged for sophisticated identity‑theft schemes, phishing attacks, or even black‑mail.

The fact that the information was linked specifically to Bitcoin activity further narrows the target demographic to users who are already considered higher‑risk by many financial regulators. ## Immediate Response and Mitigation Steps Upon discovering the error, Revolut’s security team acted swiftly.

The company: 1. **Issued an internal alert** to all relevant departments, halting any further processing of the fraudulent request. 2.

**Contacted the affected customers** directly via email and in‑app notifications, informing them of the breach, outlining what data was disclosed, and providing guidance on protective measures such as monitoring credit reports and enabling additional authentication factors. 3. **Launched a forensic investigation** with an external cybersecurity firm to trace the origin of the fraudulent request, assess the extent of the leak, and identify any potential downstream misuse of the data. 4.

**Enhanced verification protocols** for all future governmental or law‑enforcement requests, introducing multi‑factor authentication for the compliance team, mandatory cross‑checking of official identifiers, and a mandatory legal‑review step before any data is released. 5.

**Cooperated with regulatory authorities** in the United Kingdom and the European Union, providing full transparency about the breach and the steps taken to remediate it. ## Broader Implications for the Fintech Industry This incident serves as a cautionary tale for the broader fintech ecosystem, where rapid growth often outpaces the development of mature security governance frameworks.

Several key lessons emerge: * **Verification of third‑party requests must be airtight.** Even seemingly authentic government communications can be spoofed. A layered verification process—including direct phone verification with known contacts at the requesting agency—should become standard practice. * **Data minimisation is crucial.** While regulators require certain KYC documentation, firms should store only the data necessary for compliance and consider encrypting or tokenising highly sensitive fields to reduce exposure risk.

* **Customer education remains vital.** Users should be made aware that legitimate authorities rarely request personal documents via email, and they should be encouraged to report any suspicious communications. * **Regulatory oversight may tighten.** In the wake of this breach, regulators such as the Financial Conduct Authority (FCA) and the European Banking Authority (EBA) are likely to issue stricter guidance on how digital banks handle external data‑request protocols.

## What Customers Can Do Now If you are a Revolut user—or a customer of any digital‑banking platform—who may have been affected by this breach, consider taking the following actions: * **Monitor your credit reports** for any unexpected activity. In the UK, you can use services like Experian, Equifax, or TransUnion to receive alerts.

* **Enable two‑factor authentication (2FA)** on all financial accounts, especially those linked to cryptocurrency wallets. * **Be vigilant for phishing attempts** that reference the leaked data. Attackers may try to use the passport number or selfie image to craft convincing social‑engineering attacks.

* **Consider a credit freeze** if you suspect that identity theft is imminent. While this may add friction to legitimate credit checks, it can provide an additional layer of protection. * **Stay informed** about any further communications from Revolut regarding the breach, including any offers of identity‑theft protection services or compensation. ## Looking Forward Revolut has pledged to review its internal processes comprehensively and to invest in advanced AI‑driven verification tools that can detect anomalies in request patterns.

The company also announced plans to work closely with industry bodies to develop a shared framework for handling government data requests across the fintech sector. While the immediate financial impact of the breach appears limited—no customer funds were lost—the reputational damage and the potential long‑term risks to affected individuals cannot be understated.

This episode highlights the delicate balance that digital banks must strike between regulatory compliance, operational efficiency, and the safeguarding of user privacy. As the fintech landscape continues to evolve, robust security controls and a culture of vigilance will be essential to maintaining trust in an increasingly digital financial world.