Revolut Compliance Team Sent PII and Transaction Data to Impersonated Government Domain

Revolut confirmed the breach occurred when an external party submitted data requests via a valid government domain address that mimicked an official agency inquiry. The company treated the request as authentic under standard legal compliance procedures and disclosed the limited set of records before blocking the address and notifying regulators. No customer funds or core systems were accessed.

The exposed dataset included driver’s licenses, passports, verification selfies, addresses, occupations, IBANs, account statements, withdrawal records, and complete transaction histories. Revolut has not disclosed the exact number of affected users or the specific agency domain exploited, leaving independent verification of scale impossible from public statements.

This incident fits a documented pattern of targeted impersonation against fintech compliance teams that must respond to agency requests. Similar domain-spoofing tactics appeared in 2023-2024 against other European payment firms, where attackers leveraged the legal obligation to respond quickly. Revolut’s lack of number or agency disclosure contrasts with mandatory breach reporting timelines under GDPR and UK data protection rules.

Regulators and affected users should expect follow-up enforcement actions within the next quarter if the user count exceeds notification thresholds. Stronger domain and request authentication protocols, including out-of-band verification, are the immediate operational gap.