Revolut has acknowledged that scammers obtained customer information by posing as government officials — a breach reported to involve nearly 700 people.¹

The deception hinged not on a break-in to the fintech’s infrastructure, but on credibility. Fraudulent information requests arrived from an email domain belonging to a legitimate government agency, allowing an unauthorised third party to appear official. Revolut described it as a “sophisticated external impersonation scam” in which the attacker used that legitimate domain to submit false requests.²

The material handed over was potentially extensive: identity and contact details, dates of birth, postal and email addresses, phone numbers, and copies of passports or driver’s licences. Revolut’s notification to affected customers also said verification selfies, account statements and transaction histories may have been included.

After identifying the scheme, the company said it blocked the email address, contacted affected customers and alerted the relevant agency, law enforcement and regulators. It has not publicly named the agency, said whether a particular market was targeted, or provided its own precise count of those affected.

Revolut’s central defence is that the incident was an abuse of a trusted external channel, not a compromise of its platform: “Revolut systems and customer funds are unaffected.” The distinction may reassure its more than 80 million customers, but it does little to lessen the exposure for those whose identity documents and financial records may now be in criminal hands.

The disclosure lands as the London-based fintech expands internationally and pursues a larger banking footprint, putting renewed focus on how firms verify ostensibly official demands for customer data.