Revolut Gave Records to an Impostor
On 12 September 2026, Revolut confirmed that bogus requests from a genuine government email domain obtained customer records. It disabled the sender, notified customers and informed the agency, police and regulators, reporting its platform and clients’ money unaffected. No bank intrusion was reported.
Disclosure
Reported notices list names, birth dates, telephone contacts, electronic and postal addresses, and passport or driving-licence copies. Account statements, transaction histories and selfies may also feature. A publicly shared notice additionally mentioned IBANs, withdrawals and Bitcoin transactions. Categories can differ by customer.
The agency, jurisdiction, mailbox-access method, request/disclosure timing, request count, failed check and redistribution remain unestablished. Wealth-based targeting is unconfirmed. Identification copies and transaction records can assist impersonation and expose homes, workplaces, travel and transfers without giving direct access to funds.
On 16 September, Reuters separately quoted the company saying no direct demand or contact from the claimants had reached it. Its unnamed source estimated about 680 customers, without company confirmation. The report described a threatened sale, without establishing that one occurred.
Verification
A genuine address does not establish authority over a record; replying cannot independently authenticate its user. The FBI warned in November 2024 about bogus emergency requests using compromised government mailboxes. That does not establish how this incident’s address was used.
Locate the request workflow. Verify legal basis, named official, case reference and scope before export, using an independently obtained number, established portal or previously verified contact. Check legal provisions, signatures and emblems; confirm doubts with the originating authority. Fast emergency handling must retain authentication. Identify approvers; log disclosure contents, recipients and reasons, releasing only justified records. These preventive checks do not establish the bank’s undisclosed procedures.
Customer response
Customers should open the app or a bookmarked official site to review their notice and contact support. Treat subsequent emails and calls about the incident as possible impersonation. Do not supply another identity document, a temporary sign-in code or payment merely because the sender knows about the breach. Review transactions and alerts; report unfamiliar activity through official support. The company’s current fraud guidance says to end contact with a suspected scammer and contact the institutions involved. Its contact page separates customer assistance from the address reserved for authorities’ requests.
Keep the notice and ask support to clarify which categories were disclosed. If an identification copy was involved, seek the issuer’s guidance before replacing the document; replacement cannot erase an existing copy. An authentic route still needs an authorised requester and a justified scope. Platform integrity alone does not secure records disclosure.
Sources
Related: customer email checks.
