Revolut handed customer passports and selfies to an attacker posing as a government agency

Fintech company Revolut has disclosed a data breach after sharing customer data with a threat actor impersonating a government agency. Revolut operates in over 160 countries and regions and serves more than 80 million customers, including 800,000 business customers. It has not said how many people are affected. In emails to those customers, the company said the attacker requested personally identifiable information using an unauthorized email account that sent directly from an official government agency's domain. Because the message carried valid domain authentication credentials, Revolut said it fulfilled the request 'under the reasonable belief that it was an authentic government agency request.' The data shared includes identity details such as full name, date of birth, and occupation; contact details including postal address, email address, and telephone number; and document and verification data, meaning copies of identity documents such as passports or driver's licenses and the facial verification selfies customers provide for Know Your Client checks. The combination of government-issued document images and matching selfies is particularly valuable for identity fraud and account takeover at other institutions. The incident shows that email authentication alone does not prove a request is legitimate when the sending account itself has been compromised, a gap that affects any organization with a process for responding to law enforcement or regulatory data requests.