# Revolut leaked customer data to a fake government email

> Someone sent requests from a real government domain, and Revolut handed over passports and selfies.
- Title: Revolut leaked customer data to a fake government email
- Summary: Someone sent requests from a real government domain, and Revolut handed over passports and selfies. A trusted sender domain is not proof of a trusted sender…
- Keywords: fintech, security, revolut, data breach, impersonation, technology, startups, leaked, customer, data, fake, government
- Source: TechCrunch — https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests
- Author: Jagmeet Singh
- Published: 2026-09-12T14:40:00+00:00
- Read time: 1 min
- Topics: fintech, security, revolut, data breach, impersonation, technology, startups
## Revolut handed data to a stranger
The British fintech confirmed it gave sensitive customer information to an unauthorized third party who sent fraudulent requests from a legitimate government agency email domain.
## Passports, selfies, statements
Exposed data covered birth dates, postal and email addresses, phone numbers, and copies of passports and driver's licenses. It may also have included verification selfies, account statements and transaction histories.
## Revolut won't say how many
A spokesperson said a "limited" number of customers were hit and each was contacted directly. Revolut declined to give a number, name the market, or name the government agency involved.

> a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email
## What Revolut did next
It blocked the email address, then alerted the government agency, law enforcement and regulators. The company says its systems and customer funds were untouched.

> Revolut systems and customer funds are unaffected.
## The rich were the target
Crypto security researcher ZachXBT posted Revolut's customer email late Friday and said the attack looked aimed at high net worth users, the people with the most to lose from leaked ID documents.
## Bad timing for a $200B IPO
Revolut has 80 million customers, just won conditional US bank approval, and is reportedly weighing a listing valuing it near $200 billion, up from $75 billion last November.
## Key takeaway

A trusted sender domain is not proof of a trusted sender. Identity data requests need verification outside the email channel.