# Revolut data leak came from a government email

> Scammers used a real government email domain to pull passports, selfies and statements from Revolut customers.
- Title: Revolut data leak came from a government email · Pymnts
- Summary: Scammers used a real government email domain to pull passports, selfies and statements from Revolut customers. A trusted sender domain is not proof of a…
- Keywords: revolut, fintech, fraud, data breach, scams, business, finance, data, leak, came, government, email
- Source: Pymnts — https://pymnts.com/cybersecurity/2026/revolut-reveals-customer-data-leaked-in-email-scam
- Author: PYMNTS
- Published: 2026-09-13T21:54:04+00:00
- Read time: 1 min
- Topics: revolut, fintech, fraud, data breach, scams, business, finance
## Revolut customers exposed
The British fintech confirmed that sensitive information belonging to a limited number of its customers leaked in an email scam.
## The scam used a real gov domain
An unauthorised third party sent requests from a legitimate government email address, so the messages passed every surface check Revolut would normally make.
## Money was never touched
Revolut blocked the address, told the government agency involved, and reported it to regulators, police and data-protection authorities.

> Revolut systems and customer funds are unaffected
## What the scammers actually got
Birth dates, postal and email addresses, phone numbers, passports and driving licences. They may also have seen verification selfies, statements and transaction histories.
## Fraud attempts are climbing
PYMNTS surveyed 150 senior executives across seven industries: 57% said fraud attempts rose over the past year.
## The defence already in the building
69% of firms use secure bank connections for account and routing numbers, but only 49% use them for real-time fraud signals. Same pipe, half the value.

> Think of it as a security camera that checks identification at the entrance but could also help monitor activity inside
## Key takeaway

A trusted sender domain is not proof of a trustworthy request, and the data handed over can be far more damaging than money.