Revolut Hands Passports, Selfies and Bitcoin Records to Fake Government Requesters

No zero-day, no malware. One well-formatted email opened the vault.

Three key facts

Revolut confirmed on September 12 that it disclosed sensitive customer data to a third party posing as a government agency. The requests came from an email account on a legitimate government agency domain, passed authentication checks and convinced staff they were genuine. Revolut won't name the agency or the country, and won't say how many customers were hit beyond calling it a limited number, all of whom it says it has contacted.

What leaked is close to a complete identity kit. Dates of birth, postal and email addresses, phone numbers, copies of passports and driver's licenses, verification selfies, account statements and transaction histories, plus IBANs and Bitcoin wallet references, according to CoinDesk. Revolut stresses its systems and customer funds were not affected.

The timing is awkward. Revolut has more than 80 million customers across 30-plus countries, secured conditional approval for a U.S. national bank charter from the OCC this month, and is lining up an IPO that could value it at up to $200 billion.

WangDou's Take

KYC's bargain goes like this: for your safety, hand us your passport, your selfie and your home address. Then that very bundle got mailed out in response to a polite email. The insurance users were required to provide became the combo meal fraudsters dream about.

The phrase that the email passed authentication deserves a second look. Authentication proves a message came from that government mailbox. It says nothing about who was typing. Impersonating law enforcement to pull user data isn't new either; Apple and Meta both fell for it back in 2022. A company chasing a $200 billion valuation, fresh off a U.S. bank charter nod, was still vetting data requests by checking the sender's domain.

For a scammer, this file is worth far more than one card fraud. A passport, a selfie and proof you hold bitcoin: the next targeted phishing campaign has practically written itself.

Source: TechCrunch · CoinDesk