Revolut, the digital banking platform, confirmed on September 12, 2026, that it inadvertently disclosed sensitive customer Know Your Customer (KYC) data to an unauthorized third party. The disclosure occurred after the company received fraudulent information requests that appeared to originate from a legitimate government agency's email domain.
According to Revolut's customer notification, which began circulating on September 11, the fraudulent emails passed internal security checks because they carried valid domain authentication credentials. This led Revolut staff to believe the requests were authentic and from an official government authority. The company stated that the request came from "an unauthorised email account sent directly using the official government agency's email domain."
The compromised data included a comprehensive set of customer identity and contact details. Specifically, this encompassed full names, dates of birth, occupations, postal and email addresses, and phone numbers. Furthermore, copies of identity documents such as passports and driver's licenses were exposed, along with facial verification images (selfies provided during the verification process). Revolut clarified that no biometric facial telemetry data was involved. Financial data was also compromised, including account statements (containing IBANs, account status, opening dates, and wallet reference numbers), withdrawal records, and full transaction histories, which multiple sources confirmed included Bitcoin transactions.
Revolut emphasized that this incident was not a traditional technical breach involving compromised systems, malware, or unauthorized access to its servers. Instead, the attacker either created a rogue account within an official government agency's domain infrastructure or compromised an existing one, subsequently using it to submit what appeared to be a legitimate data request. The fraud was only discovered when Revolut independently contacted the government agency to verify the request, at which point the agency confirmed it had not initiated it.
The company stated that a "limited number of customers" were affected and that those impacted were immediately notified. However, Revolut did not disclose the exact scope of the incident, nor did it name the government agency involved or specify any particular country or market affected. This lack of detail has been noted as a potential concern for other fintech companies that might have received similar fraudulent requests.
A cryptocurrency security researcher, ZachXBT, who shared Revolut's customer notification, suggested that the incident appeared to be a targeted operation aimed at high-net-worth individuals. If accurate, this implies a focused effort to build detailed profiles of wealthy individuals using their KYC documents and cryptocurrency transaction histories linked to their real identities. Such information, combined with IBANs and account statements, could be exploited for fraud, impersonation, or extortion.
In response to the incident, Revolut stated it has blocked the fraudulent email address, alerted the involved government agency, notified law enforcement, and reported the incident to financial regulators. The company also affirmed that its systems and customer funds remain unaffected.
This incident occurs as Revolut pursues greater regulatory credibility, including recently securing conditional U.S. approval to become a national bank and reportedly considering a $200 billion IPO, while serving 80 million customers globally. The event highlights potential vulnerabilities in fintech data-request processes that rely primarily on email authentication, demonstrating how attackers with access to a government domain could bypass checks to obtain sensitive customer data.
