Revolut Accidentally Shares Passports and Bitcoin Records After Fake Government Request

How the Scam Bypassed Security Checks

London, September 12 2026 – Revolut, the UK‑based fintech firm, disclosed that it unintentionally handed over sensitive customer information, including passport scans, selfie verification images and complete Bitcoin transaction histories, after complying with a fraudulent request that appeared to come from a legitimate government agency. The incident, revealed in a statement on Monday, affected a „limited” number of users and was described by the company as a „sophisticated external impersonation scam.”

The deception hinged on an email that used the authentic domain of a national authority, tricking Revolu­t’s compliance team into believing the request was genuine. Once the request was processed, the data was transmitted to the attackers, who then could exploit the personal identifiers and financial records for illicit purposes. Revolut’s internal audit flagged the breach after an unrelated security review, prompting an immediate investigation and notification of affected customers. The company emphasized that the breach did not involve passwords or account balances, but acknowledged the seriousness of exposing identity documents and cryptocurrency activity.

The fraudulent email replicated the exact formatting and security markers used by the real agency, including digital signatures that verified the sender’s domain. Revolut’s automated verification system, designed to streamline lawful data requests, accepted the message without triggering additional manual review. A senior compliance officer, who requested anonymity, explained that „the request matched our standard template for lawful disclosure, so it was processed under normal procedures.” The scam exploited a gap in the firm’s multi‑factor authentication for external requests, a weakness that the company now says it will close.

Could Similar Attacks Target Other Fintech Services?

In response, Revolut has launched a comprehensive overhaul of its data‑request protocol. New safeguards will require direct phone verification with the requesting authority, encrypted channels for transmitting documents, and a mandatory secondary approval from a senior legal officer. The firm also pledged to provide free identity‑theft protection services to anyone whose passport or selfie was exposed. Industry analysts warn that the incident highlights the broader vulnerability of fintech platforms to social engineering attacks that mimic official communications.

Security experts say the technique used against Revolut could be replicated across the sector. „Any service that processes government data requests is a potential target if its verification steps are not robust,” noted a cybersecurity consultant at a London think‑tank. The consultant added that the rise of cryptocurrency has made transaction histories especially valuable to criminals seeking to trace or launder funds. As regulators tighten AML (anti‑money‑laundering) requirements, more agencies will request detailed crypto data, increasing the attack surface for impersonation scams.

Revolut’s incident serves as a warning that the convenience of digital verification can become a liability if not paired with rigorous authentication. Companies are urged to audit their request‑handling workflows and train staff to recognize subtle signs of spoofed communications.

The breach has already prompted regulatory scrutiny. The UK’s Financial Conduct Authority announced it will review Revolut’s compliance framework, while data‑protection authorities are assessing whether the company met its obligations under GDPR. Customers whose documents were leaked may face heightened risk of identity theft, prompting calls for stronger consumer safeguards in the fintech industry.

Frequently Asked Questions

What information was disclosed in the breach? Revolut transmitted passport copies, selfie verification images and full Bitcoin transaction histories for a small group of customers. No passwords or account balances were shared.

How did the attackers convince Revolut to release the data? They sent an email that used the official domain of a government agency and included authentic‑looking digital signatures, making the request appear legitimate to Revolut’s automated compliance system.

What steps is Revolut taking to prevent future incidents? The firm is adding mandatory phone verification with requesting authorities, encrypting all data transfers, requiring secondary legal approval for requests, and offering free identity‑theft protection to affected users.