From Pymnts · PYMNTS · · 1m 20s
Revolut data leak came from a government email
Scammers used a real government email domain to pull passports, selfies and statements from Revolut customers.
In brief
Scammers used a real government email domain to pull passports, selfies and statements from Revolut customers. A trusted sender domain is not proof of a trustworthy request, and the data handed over can be far more damaging than money. Originally reported by Pymnts.
Revolut customers exposed
The British fintech confirmed that sensitive information belonging to a limited number of its customers leaked in an email scam.
The scam used a real gov domain
An unauthorised third party sent requests from a legitimate government email address, so the messages passed every surface check Revolut would normally make.
Money was never touched
Revolut blocked the address, told the government agency involved, and reported it to regulators, police and data-protection authorities.
“Revolut systems and customer funds are unaffected”
What the scammers actually got
Birth dates, postal and email addresses, phone numbers, passports and driving licences. They may also have seen verification selfies, statements and transaction histories.
Fraud attempts are climbing
PYMNTS surveyed 150 senior executives across seven industries: 57% said fraud attempts rose over the past year.
The defence already in the building
69% of firms use secure bank connections for account and routing numbers, but only 49% use them for real-time fraud signals. Same pipe, half the value.
“Think of it as a security camera that checks identification at the entrance but could also help monitor activity inside”
At a glance
A trusted sender domain is not proof of a trustworthy request, and the data handed over can be far more damaging than money.
