Topic
Security and fraud practice at digital banks and payment companies, covering customer data protection, account takeover and regulated operational controls.
Fraudsters posing as a verified government requester tricked Revolut into handing over sensitive records on about 640 customers. The breach defeated a human process.
The fraudulent request passed domain authentication because it genuinely came from the agency's mail domain, sent by an account the agency had not authorised. Revolut found out only when it called the agency to check.
Perspective Coverage
8 publishersReality
Revolut answered fraudulent information requests sent from a real government email account for months. A group calling itself iamnotavillain now wants about $3 million in Monero for the roughly 680 customer files.
Reality
Malwarebytes found smishing texts exploiting Revolut's breach within two days of the bank confirming it. The phishing flow asks for the phone camera and imitates the bank's own video identity check.
Reality
A hacker used a government employee's infostealer-compromised mailbox to send fraudulent requests to Revolut's Lithuanian subsidiary for about five months, and roughly 680 customers' passports and financial data went out.
Reality
Revolut says its own systems were not breached; the fraudulent European Investigation Orders arrived from an authentic pec.interno.it mailbox, and the actor behind them claims six months inside Italian law-enforcement systems.
Reality