Revolut Shared KYC Documents and Full Transaction Histories After Government Impersonation Scam

British fintech giant Revolut has confirmed that sensitive customer information was disclosed after a fraudster impersonated a government agency and submitted fraudulent requests for data using an email address from a legitimate government domain.

The company said a “limited number” of customers were affected by what it described as a sophisticated external impersonation scam.

Passports, selfies and transaction histories exposed

The information disclosed included extensive Know Your Customer (KYC) data, including customers’ full names, dates of birth, occupations, postal and email addresses and phone numbers.

Copies of identity documents, including passports and driver’s licenses, as well as selfies submitted by customers during identity verification, were also among the information shared.

The exposed records additionally included account statements containing IBAN numbers, account status, opening dates and wallet reference numbers, along with withdrawal records and complete transaction histories, including Bitcoin transactions.

Revolut says systems and customer funds were unaffected

Revolut said its internal systems were not compromised and customer funds were unaffected.

After detecting the fraudulent requests, the company said it immediately blocked the address involved and notified the affected government agency, law enforcement bodies, data-protection authorities and financial regulators.

Revolut is contacting affected customers and offering additional support, although it has not disclosed the exact number of people whose information was shared.

Fraudster allegedly used legitimate government email domain

Financial institutions are legally required to respond to legitimate information requests from law-enforcement and government agencies, which are normally submitted through verified official channels.

It remains unclear how the attacker managed to submit fraudulent requests using an email address associated with a legitimate government agency domain.

Revolut has more than 70 million customers across over 40 countries and was recently valued at approximately $75 billion.