Revolut trusted a real government domain

The email came from a real government domain. It passed the standard checks that verify a message genuinely originated from the organisation it claimed to represent. And it requested customer records. So Revolut complied, sending identity documents, selfies, bank statements and transaction histories to the sender. The sender turned out to be a fraud (TechCrunch).

The fintech confirmed the incident on Saturday after affected customers began sharing notification emails. Former Mt. Gox chief executive Mark Karpelès publicly posted his, establishing himself as one of the victims (The Block). Revolut reported no unauthorised access to its banking platform and said no funds were stolen during the incident. It released the records in response to the fraudulent requests, deceived by what its own notice described as an unauthorised account created inside the genuine email infrastructure of an unnamed government agency (Security Affairs).

The Postmark Was Real. The Writer Wasn't Authorised.

When you receive an email, your provider silently runs authentication checks. These verify that the sending server was authorised by the domain owner and that the message wasn't altered in transit. Think of it as confirming a letter bears a genuine postmark from a real government post office.

The postmark can be genuine without proving the writer was authorised to make the request. Revolut's notice indicates that valid domain authentication was a key reason it treated the request as legitimate. The company has not disclosed whether it independently verified the requester or legal authority before releasing the records (Security Affairs, CyberInsider).

Revolut first released the information. Only afterwards did it independently contact the government agency and learn the requests were unauthorised. It then blocked the sender, alerted authorities and notified customers (TechCrunch, Reuters/WHBL).

How the unauthorised mailbox came to exist remains unresolved. It could have been a compromised existing account, a new account created through an administrative weakness, or an insider-assisted creation. Revolut has not identified the agency, its country, the domain or the attacker (TechCrunch).

What Left the Building

The customer notice listed a comprehensive package. Identity documents included passport and driving-licence copies, the selfie taken during onboarding, full name, date of birth and occupation. Contact details included postal address, email and phone number. Financial records included account statements with IBAN, withdrawal records and complete transaction history, including Bitcoin transactions (TechCrunch, The Block).

Revolut's notice drew a distinction: the onboarding selfie was released, but not the mathematical template that a facial-recognition system produces from it. A photograph of a face is still sensitive. Paired with a passport scan, such a combination could help an attacker attempt identity fraud, though many verification systems also require liveness tests and other checks.

Passwords, one-time codes, card numbers, authentication tokens and crypto private keys were not among the disclosed records. Those are the secrets used to log into an account. What the exposed data can do is make targeted phishing more convincing. A criminal citing genuine transactions, real account numbers and a known address is harder to dismiss than one sending a generic scam (NCSC data-breach guidance).

Revolut described a "limited number" of affected customers but gave no total, no country breakdown and no timeframe. Belgian media reported Belgian victims through unnamed sources, though no primary confirmation exists (The Brussels Times).

The verification failure sits at the centre of this incident. Email domain authentication tells a bank which organisation's infrastructure sent a message. It says nothing about whether the person using that infrastructure had authority to demand customer files. Banks that treat domain checks as sufficient verification of a data request are exposed to exactly this kind of deception. Authenticating the requester and the legal basis, not only the message's origin, is the gap Revolut's experience has made visible.