Revolut confirmed on September 12, 2026 that it disclosed customer passports, verification selfies, and complete Bitcoin transaction histories to an unauthorized party after receiving a request from an email account hosted on a genuine government agency domain. The request passed SPF, DKIM, and DMARC authentication checks. Revolut describes the incident as “a sophisticated external impersonation scam” involving a “limited” number of customers, but has not published a victim count or named the agency whose infrastructure was used.
In this article
What Revolut Actually Sent
The exposed data included birth dates, postal and email addresses, phone numbers, and copies of identity documents including passports and driver’s licenses, according to notifications reviewed by TechCrunch. The disclosed data also included verification selfies, IBANs, account statements, and Bitcoin wallet reference numbers. Full transaction histories, including Bitcoin transactions, were handed over.
The request originated from an account created within the authority’s own domain infrastructure and passed the checks commonly used to detect spoofed mail – SPF, DKIM and DMARC. The company handed over customer information before separately contacting the agency and discovering that the request was fraudulent. Only later, when the company contacted the agency to confirm the demand, did it learn that the mailbox was unauthorized. That outreach also alerted the government body to the rogue account on its own systems.
The company has not disclosed the agency involved, the exact number of affected customers or the period during which information was exposed. Blockchain investigator ZachXBT, who surfaced the customer notice, said the incident appeared to have been targeted at high net worth users. Former Mt. Gox CEO Mark Karpeles said he was among those affected.
A Perfect Set of Credentials Without Hacking Anything
The disclosure did not result from a compromise of Revolut’s core systems, mobile application, or customer accounts. The incident appears to have involved abuse of an authorized government email environment rather than a breach of Revolut itself. SPF, DKIM and DMARC were all reporting accurately. Those protocols answer one question, defined in RFC 7489: was this message sent by infrastructure the domain owner authorizes? When the attacker operates a real mailbox on that domain, the honest answer is yes.
Revolut’s compliance team had every technical reason to believe the request was genuine. So they processed it, handing over customer records to an unauthorized third party who had essentially forged a perfect set of credentials without ever touching Revolut’s internal systems. No passwords were stolen. No PINs or private keys were compromised. No customer funds were moved. But a trove of personal and financial data walked out the door through the front entrance.
The mechanics are not mysterious. Like other regulated financial institutions, Revolut must respond to valid requests for customer information from law enforcement and government agencies. Financial institutions receive government data requests constantly. Law enforcement inquiries, court orders, regulatory demands. They are built to comply with these when properly verified. What happened at Revolut is a failure of that verification layer, not a technical breach in the conventional sense.
This Attack Vector Has Been Public Since 2022
As far back as 2022, security researcher Brian Krebs documented how attackers were spoofing emergency data requests to extract customer information from service providers. The FBI warned companies in November 2024 that credentials for police and government mailboxes were selling openly on criminal forums, after sellers began offering government mailboxes with coaching on how to use them.
The proposals to solve this, such as requiring digital signatures on government requests, have not been widely implemented. Even if they were, they would not fully address the problem of compromised accounts operating within legitimate government infrastructure. The problem is structural: email authentication protocols verify that a sender controls a mailbox on a domain, not that the sender is authorized by the organization that owns the domain. When an attacker compromises a government mailbox or creates one without authorization, every technical check passes.
The regulatory framework governing how financial institutions respond to government requests assumes those requests are either legitimate or obviously fraudulent. FinCEN receives requests from federal law enforcement agencies and, after review, transmits those requests to designated contacts within financial institutions across the country once every two weeks. Financial institutions are required to provide customer financial records to government authorities only after receiving the proper written certification. That certification verifies the request is lawful, not that the person sending the email is who they claim to be.
Government-impersonation phishing has become a priority threat against regulated industries. The pretext exploits the one behavior security awareness training struggles to eliminate: deference to authority under time pressure. It targets the process rather than the password. Multi-factor authentication is irrelevant when the credential was never stolen; the attacker never needed a session cookie because the data arrived as an attachment.
The Records That Cannot Be Changed
The inclusion of cryptocurrency transaction records, including Bitcoin activity, is particularly sensitive because it could help criminals profile victims’ wealth, trading behavior, wallet usage, and potential exposure to targeted scams. Cryptocurrency transaction data, combined with identity documents and verification selfies, gives bad actors a fairly complete toolkit for identity fraud, social engineering, or even targeted phishing campaigns against crypto holders.
The information handed over was exactly the kind a regulated fintech is obligated to collect and keep: passport or ID scans, biometric selfies used for liveness checks, and a record of on-chain activity tied to a named individual. Compliance data is a honeypot. To operate legally, platforms like Revolut collect and store the most identity-revealing documents a person owns, then link them to financial behavior. The value of a KYC archive to an attacker is not that it is hard to steal, but that once stolen it cannot be changed. You can reset a password. You cannot reset your face or your passport photo.
A password can be changed in a minute. A passport cannot. The exposed records now enable follow-on attacks that institutional security controls cannot prevent. The exposed records contain exactly the details attackers would use to impersonate customer service, initiate account recovery workflows, or construct convincing pretexts for further fraud.
Revolut has not disclosed whether the attack was opportunistic or targeted, but the scope of the data and the choice of victims suggests intention. Revolut has published no victim count, no date range for the requests, and no name for the agency whose domain was used. Without a count, nobody can tell whether “limited” means nine people or nine hundred. Without the agency name, every other firm that answers requests from that same domain is still exposed and does not know it.
The Architectural Problem Is Collection, Not Protection
The lesson here is not that Revolut failed to protect customer data. The lesson is that the data existed in a concentrated, linked, and legally mandated form that made it a single point of failure. The same regulatory requirements that force financial institutions to collect and retain identity documents, biometric images, and transaction histories also make those institutions honeypots for attackers who understand how to manipulate the legal request process.
A technical breach requires an intrusion detection response. A successful government impersonation attack requires rethinking what data regulated entities are required to hold and how long they must keep it. The problem is not the email authentication protocol; the problem is that KYC requirements centralize the most sensitive identity and financial data in systems designed to answer government requests quickly. Every institution that holds this data and answers these requests is exposed to the same vector.
Verification does not require permanent retention. Decentralized verification schemes, zero-knowledge proofs, and selective disclosure protocols can satisfy regulatory requirements without creating a permanent dossier that links a face, a passport number, a home address, and a transaction history. None of these are hypothetical. They are operational and used by services that prioritize architecture over compliance theater.
Email verification does not require biometric selfies or government-issued ID scans. For users who require verifiable claims without centralized identity storage, protocols like PQCServer enable cryptographic proofs that satisfy third-party requirements without transmitting or storing the underlying documents. The architecture assumes that the entity verifying identity and the entity operating the service are not the same, and that documents should never enter a system designed to answer government requests.
The Revolut incident does not demonstrate sophisticated attackers exploiting a zero-day vulnerability. It demonstrates attackers exploiting the expected behavior of a compliance process that was designed assuming government requests are always legitimate or always detectable as fraudulent. That assumption no longer holds.
Trajectory
The market for compromised government mailboxes will expand, not contract. The FBI warning in November 2024 was not predictive, it was descriptive. The infrastructure for this attack already exists, is actively traded, and has now been demonstrated against a regulated financial institution with 80 million customers and a pending US banking license. Every other financial institution that relies on email domain authentication to verify government requests is exposed to the same vector. The problem is not solvable by adding another verification step; the problem is that the verification process assumes that control of a mailbox implies authorization by the organization, and attackers now routinely violate that assumption. The structural fix is to reduce what is collected, limit how long it is kept, and separate verification from storage. Until that happens, every centralized KYC archive remains a target, and every government email domain remains a potential vector.