Two incidents, one pattern

Revolut was tricked by a fake government data request using a real but compromised Italian email system. The Fed's National Information Center suffered an outage that disrupted financial monitoring systems. Neither bank's core systems failed.

Revolut's impersonation scam

Attackers impersonated law enforcement over several months using a compromised government email address, convincing Revolut to share sensitive customer data including identity documents, selfies, addresses, and transaction histories.

“Revolut recently identified a sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information.”

What made this attack work

Banks can verify that a message came through real government infrastructure, but they can't easily verify that the person using it has legitimate authority to request specific customer data. This gap is the vulnerability.

Banks hold valuable targets

Know your customer and anti-money laundering rules require banks to store passports, driver's licenses, addresses, photos, and detailed financial histories. These same security controls that prevent crime create unusually valuable targets for attackers.

The Fed's infrastructure outage

The Federal Reserve's National Information Center, used by regulators to collect and share information about financial institutions, suffered an August outage that disrupted internal systems and data pipelines across multiple Fed business areas.

Banks can't replace regulators

Financial institutions can negotiate backup processors and diversify vendors, but they can't switch regulators or dictate the technical architecture of government systems they're required to use.

Identity spending keeps rising

Financial institutions spent 21 billion dollars in 2025 on identity verification and know your customer systems. Spending is projected to reach 39 billion by 2030, with 65 percent of firms planning to expand these systems in the next year.

Fraud is getting more sophisticated

Sixty-eight percent of financial institutions increased fraud detection budgets year over year. Forty-six percent reported sophisticated fraud schemes, up from thirty-five percent a year earlier.

The perimeter is disappearing

Banks can have functioning servers, security controls, and employees but still suffer consequences because something outside their control failed or was successfully impersonated. The next risk perimeter may not be a perimeter at all.