Revolut handed data to a stranger

The British fintech confirmed it gave sensitive customer information to an unauthorized third party who sent fraudulent requests from a legitimate government agency email domain.

Passports, selfies, statements

Exposed data covered birth dates, postal and email addresses, phone numbers, and copies of passports and driver's licenses. It may also have included verification selfies, account statements and transaction histories.

Revolut won't say how many

A spokesperson said a "limited" number of customers were hit and each was contacted directly. Revolut declined to give a number, name the market, or name the government agency involved.

“a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email”

What Revolut did next

It blocked the email address, then alerted the government agency, law enforcement and regulators. The company says its systems and customer funds were untouched.

“Revolut systems and customer funds are unaffected.”

The rich were the target

Crypto security researcher ZachXBT posted Revolut's customer email late Friday and said the attack looked aimed at high net worth users, the people with the most to lose from leaked ID documents.

Bad timing for a $200B IPO

Revolut has 80 million customers, just won conditional US bank approval, and is reportedly weighing a listing valuing it near $200 billion, up from $75 billion last November.