Why Revolut mistakenly handed over customer Bitcoin data after a fake official request

Revolut mistakenly handed over customer information because fraudulent government requests came from a legitimate agency domain and carried valid email authentication. The digital banking company believed the requests were authentic, even though they came from an unauthorized account.

The case shows how a convincing email can defeat a sensitive verification process without attackers directly entering a bank’s systems.

How did a fake request appear legitimate?

The request appeared legitimate because it was sent through a real government agency’s email domain. This made it more convincing than an ordinary phishing message sent from a misspelled or newly created address.

Revolut said the communication carried valid domain authentication credentials. These technical checks indicated that the email was allowed to travel through systems connected to the government domain, so the message did not look like basic email spoofing.

However, domain authentication does not automatically prove that the person controlling the mailbox is an authorized government official. It also does not confirm that the sender has a lawful reason to obtain a particular customer’s private financial records.

That difference appears to be at the center of the incident. Revolut’s process recognized the domain as legitimate, but it failed to identify that the individual using the address was not authorized to make the request.

The available evidence does not show that anyone directly entered Revolut’s customer database or took control of its banking platform. Reuters reported that the disclosure resulted from fraudulent external requests, while Revolut said its systems remained unaffected.

The company blocked the email address after discovering the problem and contacted the government agency involved. It also alerted law enforcement, data protection authorities, and financial regulators, according to its statements reported by TechCrunch.

Fun fact: Revolut said it blocked the email address upon becoming aware of the scam and notified relevant regulators, government agencies, and law enforcement.

What information may have been exposed?

The disclosure may have included a wide collection of personal, banking, and cryptocurrency records. Revolut’s customer notification listed information that could allow an attacker to build a detailed profile of an affected person.

Basic identity information included names, birth dates, occupations, email addresses, phone numbers, and postal addresses. Copies of passports and driver’s licenses may also have been provided to the unauthorized requester.

Facial verification images were included among the potentially exposed records. Revolut reportedly said biometric facial telemetry was not affected, but ordinary verification selfies can still be sensitive when combined with names and official documents.

Financial data may have included account statements, account status, account opening dates, IBANs, and withdrawal records. Full transaction histories and Bitcoin-related activity were also listed in notices shared by some affected customers.

The notice described categories of information that may have been disclosed. It does not prove that every listed category was released for every customer, so the article should avoid suggesting that all affected people lost the same records.

Revolut said a limited number of customers were involved, but it did not provide an exact count. The company also declined to identify the affected country or confirm if customers from several markets were included, according to The Block.

Why are Bitcoin records especially sensitive?

Bitcoin records create a special privacy concern because blockchain transactions are publicly visible. The blockchain does not normally display a person’s passport, home address, SSN, or legal name beside each transaction.

A regulated financial company can hold the missing connection between public blockchain activity and a real customer. If transaction histories and wallet references are disclosed with identity records, an attacker may be able to connect financial activity to a specific person.

That connection could reveal transaction patterns, approximate holdings or relationships with other wallet addresses. It could also help criminals identify people they believe own valuable cryptocurrency, even when those assumptions are incomplete or inaccurate.

Revolut emphasized that customer funds were unaffected, which means the known incident did not directly remove money or Bitcoin from accounts. However, safe funds do not erase the risks created by exposed identity documents, contact information, and financial histories.

Crypto investigator ZachXBT suggested that the incident appeared to target wealthy customers. That assessment remains unconfirmed because Revolut has not said cryptocurrency holders or high-net-worth customers were deliberately selected.

Unlike a password, personal history cannot easily be replaced after exposure. A customer can change login credentials, but cannot change an old Bitcoin transaction, birth date, or previously issued identity record as easily.

Fun fact: Revolut has not named the agency, the markets involved, or the number of customers, and says its systems and customer funds were unaffected.

What important details remain unanswered?

Revolut has not identified the government agency whose domain was used. That decision may protect the continuing investigation, but it prevents the public from understanding which government system or account became involved.

It is also unclear how the unauthorized sender gained access to the agency’s domain. The mailbox could have been compromised, improperly created, or misused by someone with access, but none of those possibilities has been officially established.

The number of fraudulent requests also remains unknown. Revolut has not explained how long the activity continued, how many requests were approved, or what event finally caused its security team to recognize the deception.

Reports have also circulated that people claiming responsibility demanded 10,000 BTC and threatened to release customer information. That demand has not been confirmed by Revolut, Reuters or TechCrunch, so it should be described only as an unverified claim attributed to alleged attackers.

The company has not publicly provided a complete record of which data fields were released for each affected customer. It also has not said if any disclosed identity documents have appeared online or been used in later fraud attempts.

Responsibility for the breakdown has not been fully explained either. The incident may involve security failures outside Revolut, but the company still made the final decision to disclose customer records based on requests that turned out to be fraudulent.

What should customers and banks do next?

Affected customers should rely on messages delivered through Revolut’s official app or other verified company channels. Unexpected emails requesting passwords, verification codes, payments, or identity documents should be treated with added caution after this disclosure.

Attackers could use exposed details to create highly personalized phishing messages. A scam that includes a real address, recent transaction or account detail may appear convincing even when the sender does not control the customer’s Revolut account.

Customers should review their account activity, strengthen login protection and report suspicious communications through Revolut’s official support system. U.S. consumers concerned about identity theft can also review Federal Trade Commission guidance on fraud alerts, credit freezes and recovery steps.

Banks should independently verify sensitive government requests through a second trusted channel before releasing records. Staff could contact the agency through a previously verified phone number or secure portal instead of relying only on information contained in an incoming email.

Financial companies should also limit each disclosure to the records legally required by a valid request. Strong approval controls, separate staff reviews and detailed request logs can reduce the damage caused by a compromised government account.

The timing may be especially important as Revolut continues expanding its banking operations and prepares for a future U.S. national bank launch. The incident does not prove American customers were affected, but it could increase attention on how the company protects data and verifies official requests.

TL;DR

• Revolut released sensitive customer information after fraudulent requests arrived from an unauthorized email account using a real government agency’s domain.
• The messages passed normal domain authentication, but that authentication did not prove the sender had legal authority to request customer records.
• Potentially exposed information included identity documents, verification selfies, addresses, bank statements and transaction histories containing Bitcoin activity.
• Revolut said its systems and customer funds were unaffected, but exposed identity and financial records could still support targeted scams or identity theft.
• Key details remain unknown, including the agency involved, the number of affected customers and how the unauthorized sender gained access to the official domain.

This article was made with AI assistance and human editing.

If you liked this, you might also like:

• Coldcard exploiter moves 45% of stolen Wave 3 funds, but could millions in Bitcoin still be at risk of being laundered?
• Could Dogecoin’s confirmed bullish breakout finally put the $1 target back in focus after months of weakness?
• Why Trump is distancing himself from TRUMP Coin as the token falls 5% and traders reassess its future