An Impostor Used a Real Government Email to Get Revolut’s Customer Records

A fraudulent request from a genuine government email domain persuaded Revolut to disclose sensitive customer records. The failure was in verifying who had authority to ask.

A fraudulent request from a genuine government email domain persuaded Revolut to disclose sensitive customer records. The failure was in verifying who had authority to ask.

A cyberattack on Latvia’s Road Traffic Safety Directorate exposed payment-receipt records belonging to 1.2 million people and 200,000 legal entities. The archive stretched back to 2008 and linked identity data to addresses, vehicle registration plates, payment dates, and amounts. The…