British fintech Revolut has confirmed that it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent information requests sent from a legitimate government agency email domain. The company said a limited number of customers were affected, while its own systems and customer funds were not compromised.
Information disclosed in the incident could include customers’ names, birth dates, postal and email addresses, phone numbers and copies of government-issued identification documents such as passports and driver’s licenses. Revolut told affected customers that verification selfies, account statements and transaction histories may also have been exposed.
Fraudulent Requests Came From a Legitimate Government Domain
Revolut described the incident as a sophisticated external impersonation scam rather than an intrusion into its infrastructure. An unauthorized party used an email address belonging to a legitimate government agency domain to submit requests that appeared authentic, causing Revolut to disclose customer information.
After discovering the activity, Revolut said it blocked the email address and notified the government agency involved, law enforcement authorities and relevant regulators. The company has not identified the agency, disclosed which countries were affected or provided the number of customers whose information was shared.
Revolut maintains a dedicated process for official requests from authorities, including court orders and requests for customer information. The company said it has contacted affected customers directly following the incident.
Crypto security researcher ZachXBT publicized one of the notification emails sent by Revolut and said the incident appeared to target high-net-worth customers. Revolut has not confirmed that characterization.
Incident Comes During Revolut’s Global Expansion
Revolut serves more than 80 million personal customers and operates as a bank in more than 30 countries, according to the company. It has been expanding in markets including India, Mexico, France, the United Arab Emirates and the United States.
Earlier in September, Revolut received conditional approval for a U.S. national bank charter, an important step toward launching Revolut Bank US. The company expects the proposed bank to begin operating in 2027, subject to remaining approvals from U.S. regulators.
The incident also comes as Revolut considers a possible public listing. The company was valued at $75 billion in a private transaction in November 2025, while reports earlier this year suggested a future IPO could value it at as much as $200 billion.
Revolut said it continues to investigate the fraudulent requests and stressed that customer funds remain unaffected.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.