Revolut handed over KYC files on a fake government email. No hack required.

Not every headline breach starts with malware. Revolut confirmed on September 12 that a limited set of customers had sensitive data disclosed after the company fulfilled information requests it believed came from a legitimate government agency. Passports, driver licences, verification selfies, account statements, IBANs, and full Bitcoin transaction histories left the building. Customer funds and core systems were reportedly untouched.

What actually happened

According to customer notifications reviewed by TechCrunch and reporting from BNO News, someone used an unauthorized mailbox on a genuine government agency email domain. The messages passed normal domain authentication. Revolut treated them as lawful disclosure requests, which regulated financial firms are required to answer when they look legitimate.

After verifying with the agency, Revolut blocked the address, notified regulators and law enforcement, and emailed affected customers. The company has not named the agency or published a headcount. On-chain investigator zachXBT, whose tip helped surface the story, described the targets as a small circle of wealthy users. Revolut called it a sophisticated impersonation scam, not an intrusion into its own infrastructure.

Why this is a security story, not just a fraud story

Security teams spend years on firewalls and endpoint agents. Compliance teams spend years on lawful access procedures. This incident sits exactly at the seam. The attacker did not need to exploit Revolut's API. They needed a process that defaults to trust when SPF, DKIM, and DMARC align and the letterhead looks right.

For crypto holders the damage profile is specific. Bitcoin transaction history is permanent public metadata once someone knows your cluster. Pair that with government-quality identity documents and you have a targeting package, not a generic credential dump.

Lessons for any org that answers legal or regulatory requests

• Callback verification on a known agency contact should be mandatory for bulk or high-sensitivity production, even when the email domain is authentic.
• Segment what a single approved request can pull. Full KYC plus complete chain history is a lot of eggs in one basket.
• Log every disclosure with requestor identity, approver, and data classes released. You will need that timeline for regulators.
• Train analysts that authenticated email is not the same as authorized email. Compromised or mis-issued government mailboxes are a real scenario.
• If you serve financial or legal clients, review your own subprocessors' disclosure playbooks. Their mistake becomes your client call.

Bottom line

Revolut's case is a reminder that human process and vendor trust are attack surfaces too. Forensic Five reviews web apps, access workflows, and third-party integrations for organizations that need evidence-backed answers on questionnaires and insurance forms. We work from St. Albert, Alberta. No hype, just what we can verify.