Revolut Confirms Data Disclosure Due to Fraudulent Government Impersonation Requests

This incident underscores vulnerabilities in compliance processes for handling government data requests, impacting customer trust in fintech.

• Revolut disclosed sensitive customer data in response to fraudulent requests impersonating a legitimate government agency.
• Affected customers were primarily high-net-worth individuals, with notifications beginning on September 11, 2026.
• No customer funds were stolen, and core systems remained uncompromised, but the incident raises concerns about data security.

• Revolut previously faced a data breach in 2022 affecting tens of thousands of customers, highlighting ongoing security challenges.
• The current incident involved sophisticated email spoofing, where unauthorized requests passed authentication checks, revealing weaknesses in compliance workflows.
• Broader fintech security challenges are emerging, particularly regarding email authentication protocols, which are critical for protecting customer data.

On September 11, 2026, Revolut began notifying a limited number of customers about a data disclosure incident linked to fraudulent government impersonation requests. The company confirmed the breach on September 12, describing it as a "sophisticated external impersonation scam." The requests originated from an unauthorized account on a legitimate government domain, which had successfully passed SPF, DKIM, and DMARC checks. This incident is particularly concerning as it highlights vulnerabilities in compliance processes rather than direct system intrusions.

The data disclosed included sensitive information such as names, dates of birth, contact details, identity documents, and transaction histories, including Bitcoin transactions. Revolut emphasized that biometric facial telemetry was not shared and that the scale of the incident was limited. The company acted quickly to block the fraudulent email address and contacted the impersonated agency, law enforcement, and regulators to mitigate the impact.

This incident is part of a broader trend in the fintech sector, where companies are increasingly targeted by sophisticated scams. The reliance on digital communication and the complexities of compliance workflows can create openings for fraudsters. As fintech companies expand their services and customer bases, the potential for such incidents increases, raising questions about the adequacy of existing security measures.

The implications for Revolut are significant, as the company is pursuing expansion and a potential public listing. Maintaining customer trust is crucial, and incidents like this can undermine confidence in the company's ability to protect sensitive information. The fintech sector as a whole may face increased scrutiny from regulators and customers alike, prompting a reevaluation of data protection protocols and compliance processes.

As the industry grapples with these challenges, companies may need to invest in more robust verification systems for handling data requests. This incident serves as a reminder that even established firms can fall victim to sophisticated scams, and the repercussions can extend beyond immediate data loss to long-term reputational damage.

• High-net-worth individuals: More likely to be targeted due to the sensitivity of their financial data.
• Fintech companies: Increased scrutiny and potential regulatory changes affecting operations.
• Regulators: May impose stricter compliance requirements on fintech firms to enhance data protection.

• Regulatory responses: Watch for potential new regulations aimed at enhancing data security in the fintech sector, which could reshape compliance requirements.
• Customer trust metrics: Monitor how customer sentiment shifts in response to this incident, as trust is critical for fintech growth.
• Emerging security technologies: Keep an eye on innovations in email authentication and fraud detection that could mitigate similar risks in the future.