Revolut has confirmed the exposure of personal documents and transaction histories belonging to a limited number of customers after the company responded to a fraudulent request that appeared to originate from a government body.
The incident was disclosed on 13 September. Revolut, a London-based financial technology company operating as a digital bank without physical branches, serves approximately 70 million clients worldwide. Since March 2026 it has held a full banking licence in the United Kingdom under the supervision of the PRA and the FCA.
The attack did not involve any compromise of Revolut systems. Instead, the perpetrators submitted the request using an unauthorised email account that possessed valid credentials from a government domain, causing the message to appear legitimate to the recipient.
Data handed over included copies of passports and driver’s licences, selfies used for identity verification, full names, dates of birth, occupations, postal addresses, email addresses and telephone numbers. The package also contained bank statements showing IBAN details, complete transaction histories and records of Bitcoin activity.
The combination of verified identity documents, selfies and detailed financial records significantly increases the risk of new account fraud and highly credible social-engineering attacks that reference real transactions.
Revolut confirmed that customer funds remained secure and that its systems were not breached. The company has blocked the unauthorised email source, notified the relevant authorities and contacted all affected customers. No group has claimed responsibility and there is currently no indication that the data has been sold or published.
