Revolut Faces Scrutiny Over Data Disclosure Following Fake Government Request

How Did the Fake Request Evade Detection?

Revolut confirmed that customer information, including Bitcoin transaction records, was shared after receiving a fraudulent request that mimicked a legitimate government agency. The incident occurred when the fintech company responded to an email that appeared official but originated from an unauthorized account. Multiple users reported being notified that their personal and financial details had been disclosed in error. The breach raised immediate concerns about the security protocols in place for handling sensitive data requests.

The request, which Revolut initially believed to be genuine, exploited a gap in verification procedures that allowed attackers to impersonate government entities. Internal reviews revealed that the company lacked sufficient safeguards to authenticate the origin of such demands before releasing information. Cybersecurity experts noted that the tactic used—spoofing official communication channels—is increasingly common in targeted attacks on financial institutions. Revolut has since stated it is tightening its validation processes and working with regulators to prevent recurrence.

What Steps Is Revolut Taking to Protect Customer Data Going Forward?

The fraudulent email bypassed standard checks by using a domain that closely resembled a real government address, though subtle discrepancies were present. Revolut admitted that its staff did not perform additional verification steps, such as cross-referencing through official government portals or contacting agencies directly via verified channels. This oversight allowed the request to proceed despite red flags in the email header and timing. The company acknowledged that reliance on visual similarity alone is insufficient for high-risk data disclosures.

In response, Revolut has implemented mandatory multi-layer authentication for all government data requests, including direct confirmation through official government hotlines and encrypted portals. The firm is also enhancing employee training to recognize phishing and impersonation attempts, particularly those targeting financial data. Additionally, Revolut plans to log and audit all data-sharing incidents more rigorously, with oversight from its compliance and security teams. These changes aim to close the loophole that enabled the breach while maintaining cooperation with legitimate authorities.

What specific data was disclosed in the incident? Customer reports indicate that personal details and Bitcoin transaction histories were among the information shared, though Revolut has not released an exact list of affected data fields.

Frequently Asked Questions

How many customers were impacted by the data disclosure? Revolut has not disclosed the precise number of users affected, stating only that a numberof customers were notified about the unauthorized sharing of their information.

Is Revolut facing regulatory penalties for this incident? As of now, no formal sanctions have been announced, but the company is cooperating with financial regulators who are reviewing the matter under data protection and financial conduct rules.