Archive · 13 Sep 2026
Revolut Confirms Sensitive Customer Data Exposed in Government-Email Scam
Revolut said a scam caused some customer information to be shared with the wrong person.
The scammer used an email address from a real government agency domain, which made the requests seem trustworthy.
The information may have included contact details, birth dates, identity documents, selfies, statements, and transaction histories.
Revolut said only a limited number of customers were affected.
The company said it contacted those customers directly.
It blocked the email address after finding the scam.
Revolut also told authorities, regulators, and police.
The company said its computer systems and customers’ money were not affected.
A security researcher said the scam may have focused on wealthy customers.
Revolut said an unauthorised third party used a legitimate government agency email domain to submit fraudulent information requests.
Potentially exposed data included birth dates, addresses, phone numbers, identity documents, verification selfies, account statements, and transaction histories.
The company said only a limited number of customers were affected and that it contacted them directly, but it did not provide an exact figure.
Revolut blocked the email address and notified the government agency, law enforcement, data protection authorities, and financial regulators.
Revolut said its systems and customer funds were unaffected, while researcher ZachXBT said high-net-worth users appeared to be targeted.
- Who
- Revolut customers, Revolut, and an unauthorised third party were involved; security researcher ZachXBT reported that high-net-worth users appeared to be targeted.
- What
- Sensitive customer data was disclosed after fraudulent requests were sent from a legitimate government agency email domain.
- When
- Revolut said it acted immediately after detecting the scam; the articles do not provide a specific date for the disclosure.
- Where
- The incident involved London-based Revolut, which operates as a bank in more than 30 countries; the government agency and affected market were not identified.
- Why
- The unauthorised third party used a legitimate government agency domain to make fraudulent information requests appear genuine.
Revolut’s Account
Security Concerns
Scale of the impact
Revolut’s Account
Revolut said only a limited number of customers were affected, contacted them directly, and said its systems and customer funds were unaffected.
Security Concerns
The company has not disclosed the exact number of affected people, the specific market involved, or the government agency whose domain was used.
Targeting of customers
Revolut’s Account
Revolut described the incident as an external impersonation scam involving fraudulent information requests and said it responded by blocking the address and alerting authorities.
Security Concerns
ZachXBT said the incident appeared to target high-net-worth users, raising concerns about the sensitivity of the exposed information.
Business significance
Revolut’s Account
Revolut continues to expand, reporting more than 80 million customers and operations as a bank in over 30 countries.
Security Concerns
The disclosure could add pressure on the company as it considers a potential IPO and expands its banking operations internationally.
- Company
- Revolut, a London-based fintech and bank
- Affected customers
- A limited number, according to Revolut; the exact number was not disclosed
- Potentially exposed data
- Identity and contact details, identity documents, verification selfies, account statements, and transaction histories
- Company response
- Revolut blocked the email address and notified the relevant agency, law enforcement, data protection authorities, and financial regulators
- System impact
- Revolut said its systems and customer funds were unaffected
- Customer base
- More than 80 million customers worldwide
- Business context
- The incident occurred as Revolut expands internationally and prepares for a potential IPO reportedly valued at up to $200 billion
