--- title: Revolut handed customer identity documents to scammers... description: Revolut confirmed that fraudsters impersonating a legitimate government agency's email domain tricked the company into handing over sensitive customer data,... canonical: https://daily.dev/posts/revolut-handed-customer-identity-documents-to-scammers-who-spoofed-a-government-email-domain-qeofxsljc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Revolut handed customer identity documents to scammers who spoofed a government email domain | daily.dev og:description: Revolut confirmed that fraudsters impersonating a legitimate government agency's email domain tricked the company into handing over sensitive customer data,... og:url: https://daily.dev/posts/revolut-handed-customer-identity-documents-to-scammers-who-spoofed-a-government-email-domain-qeofxsljc og:image: https://api.daily.dev/og/posts/QeOfXsLJc.png og:image:alt: Revolut handed customer identity documents to scammers who spoofed a government email domain og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Revolut handed customer identity documents to scammers who spoofed a government email domain **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary Revolut confirmed that fraudsters impersonating a legitimate government agency's email domain tricked the company into handing over sensitive customer data, including passports, driving licences, addresses, dates of birth, phone numbers, and possibly verification selfies and account statements. Customer funds and systems were reportedly unaffected. Revolut blocked the email address, notified affected customers and regulators, and alerted the impersonated agency, but hasn't disclosed how many customers were affected, which markets were involved, or how the fraudulent requests bypassed internal verification. Crypto investigator ZachXBT surfaced the incident and suggested it may have targeted high-net-worth individuals, a claim that remains unverified. The breach comes as Revolut launches a private banking arm and pursues a reported IPO that could value the company at up to $200 billion. ## Content Revolut has confirmed it disclosed sensitive customer data to criminals who impersonated a government agency by using a compromised official email domain to submit fraudulent information requests. The exposed data includes identity documents (passports and driving licences), verification selfies, home addresses, dates of birth, phone numbers, IBANs, and full transaction history including Bitcoin transactions. Revolut says its systems and customer funds were not affected, that it has blocked the email address involved, notified affected customers, and alerted both regulators and the impersonated agency. ## What actually happened The attackers didn't spoof a fake-looking domain. They used a real, authenticated government email address - reportedly a compromised Italian government domain - to submit what appeared to be a legitimate European Investigation Order. Revolut processed the request without verifying jurisdiction or authenticity and handed over the data. This is a meaningful distinction. Standard phishing defenses check whether an email domain is real. If the domain is real and the email passes authentication checks, those defenses don't flag anything. The fraud worked precisely because it looked legitimate at the infrastructure level. Revolut has not disclosed which agency's domain was used, which markets were affected, or how many customers were impacted beyond describing it as a "very limited" number. ## Who was targeted Crypto investigator ZachXBT, who surfaced the incident publicly, claims the attackers specifically targeted high-net-worth individuals, tracing affected users through blockchain analysis. That claim hasn't been independently verified, but it fits the pattern: the exposed data - home addresses combined with passport scans and full financial history - is exactly what you'd want if you were planning physical theft or targeted fraud against wealthy crypto holders. Some reports indicate the attackers subsequently demanded a ransom, with figures cited ranging from 10,000 BTC down to around $3 million, and claimed to have also accessed Italian law enforcement systems and UK customer data. Those claims are unverified. This follows a separate 2022 Revolut breach that affected over 50,000 customers. ## The broader problem this exposes The incident cuts against a common argument made in favor of mandatory identity verification: that people with "nothing to hide" have nothing to fear from handing over their documents. What it actually demonstrates is that the security of that data depends entirely on how carefully every institution holding it handles disclosure requests - and that fintechs processing those requests at scale, without the verification procedures traditional banks have developed over decades, are a real weak point. Revolut recently launched a private banking arm targeting wealthy clients and is pursuing an IPO that could value the company at up to $200 billion. The timing is awkward. The core question the company hasn't answered publicly is what verification process it had in place for government data requests, and whether that process has now changed. ## Questions this post answers ### What customer data did Revolut expose in the recent data breach involving a spoofed government email? Fraudsters impersonating a government agency's email domain tricked Revolut into disclosing customer identity documents including passports and driving licences, along with home addresses, dates of birth, and phone numbers. Verification selfies and account statements may also have been exposed. Revolut says customer funds and systems were not affected, but has not disclosed how many customers or which markets were involved. _Following fintech security incidents like this helps developers building identity verification systems avoid similar gaps, a habit daily.dev supports._ ### How did scammers trick Revolut into handing over customer identity documents? Scammers spoofed or compromised a legitimate government agency's email domain and submitted fraudulent information requests that Revolut's compliance process accepted based on the sender's email domain alone, without additional verification. This gap allowed sensitive identity documents and personal data to be disclosed to attackers rather than the actual agency. _Developers designing verification workflows can compare real-world failures like this one via daily.dev before shipping their own compliance checks._ ## Similar posts on daily.dev - [DriveWealth breach exposes data of Revolut customers who traded US stocks](https://daily.dev/posts/drivewealth-breach-exposes-data-of-revolut-customers-who-traded-us-stocks-g4up4jk8p) · The Next Web · 0 upvotes · 0 comments - [Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider](https://daily.dev/posts/scammers-target-hundreds-of-thousands-of-crypto-owners-after-trezor-confirms-data-breach-of-email-pr-je4d4ipgf) · TechCrunch · 1 upvotes · 0 comments - [Hackers arrested over €30M bank fraud exploiting service provider flaw](https://daily.dev/posts/hackers-arrested-over-30m-bank-fraud-exploiting-service-provider-flaw-nm6xjctxm) · BleepingComputer · 0 upvotes · 0 comments - [Russians posing as Signal support to launch phishing raids](https://daily.dev/posts/russians-posing-as-signal-support-to-launch-phishing-raids-numtsppyp) · The Register · 0 upvotes · 0 comments --- Tags: [#fintech](https://daily.dev/tags/fintech), [#phishing](https://daily.dev/tags/phishing), [#data-breach](https://daily.dev/tags/data-breach), [#identity-verification](https://daily.dev/tags/identity-verification) [View this post on daily.dev](https://daily.dev/posts/revolut-handed-customer-identity-documents-to-scammers-who-spoofed-a-government-email-domain-qeofxsljc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Revolut handed customer identity documents to scammers who spoofed a government email domain","url":"https://daily.dev/posts/revolut-handed-customer-identity-documents-to-scammers-who-spoofed-a-government-email-domain-qeofxsljc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/revolut-handed-customer-identity-documents-to-scammers-who-spoofed-a-government-email-domain-qeofxsljc"},"datePublished":"2026-09-13T16:09:12.867Z","dateModified":"2026-09-18T18:39:34.458Z","description":"Revolut confirmed that fraudsters impersonating a legitimate government agency's email domain tricked the company into handing over sensitive customer data,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fa00966a97d68deef27da169aef41cc7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fa00966a97d68deef27da169aef41cc7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/revolut-handed-customer-identity-documents-to-scammers-who-spoofed-a-government-email-domain-qeofxsljc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"fintech,phishing,data-breach,identity-verification","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Revolut handed customer identity documents to scammers who spoofed a government email domain"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/revolut-handed-customer-identity-documents-to-scammers-who-spoofed-a-government-email-domain-qeofxsljc#faq","mainEntity":[{"@type":"Question","name":"What customer data did Revolut expose in the recent data breach involving a spoofed government email?","acceptedAnswer":{"@type":"Answer","text":"Fraudsters impersonating a government agency's email domain tricked Revolut into disclosing customer identity documents including passports and driving licences, along with home addresses, dates of birth, and phone numbers. Verification selfies and account statements may also have been exposed. Revolut says customer funds and systems were not affected, but has not disclosed how many customers or which markets were involved. Following fintech security incidents like this helps developers building identity verification systems avoid similar gaps, a habit daily.dev supports."}},{"@type":"Question","name":"How did scammers trick Revolut into handing over customer identity documents?","acceptedAnswer":{"@type":"Answer","text":"Scammers spoofed or compromised a legitimate government agency's email domain and submitted fraudulent information requests that Revolut's compliance process accepted based on the sender's email domain alone, without additional verification. This gap allowed sensitive identity documents and personal data to be disclosed to attackers rather than the actual agency. Developers designing verification workflows can compare real-world failures like this one via daily.dev before shipping their own compliance checks."}}]} ```