← News
/DISPATCH · 2026-09-14

Revolut Trusted a Forged Government Email and Handed Over Passports, Selfies, and Full Bitcoin Transaction Records

Digital bank Revolut confirmed a data breach on 12 September: attackers submitted an information-disclosure request from an unauthorized mailbox on a government agency official domain. The request was approved because the email passed domain authentication. Passport copies, verification selfies, and Bitcoin transaction records were released.

Digital bank Revolut confirmed a data breach on 12 September 2026. The company received a set of information-disclosure requests that appeared to originate from a government agency. Because the emails carried valid domain-authentication credentials, internal security checks treated them as authentic and delivered sensitive customer data to an unauthorized third party. Revolut classified the incident as a highly sophisticated external impersonation fraud, stressed that its systems were not compromised and customer funds were unaffected, and declined to disclose the number of affected individuals or the impersonated agency.

Incident Overview

The incident was first disclosed on 11 September by on-chain investigator ZachXBT via a Revolut customer notice. The request did not come from a spoofed sender address; it was sent from an unauthorized mailbox on a government agency official domain. Such mail passes SPF, DKIM, DMARC, and other domain-layer checks. Mail authentication only proves the message left that domain's authorized infrastructure; it does not prove the mailbox controller was authorized to make the request. Revolut independently contacted the agency, confirmed the account was unauthorized, then blocked the mailbox and notified the agency, law enforcement, and financial regulators.

Technical Details

Unlike a traditional intrusion, there was no malware and no compromised server. Attackers used a fully legitimate business channel: the routine inter-agency information-disclosure process. A usable mailbox inside government domain infrastructure made the request technically airtight. Multiple sources report the leaked fields were complete: name, date of birth, occupation, mailing address, email, phone; passport or driver's-license copies; and the facial-verification selfie submitted at account opening. Financial fields included IBAN, account status and opening date, wallet reference numbers, withdrawal records, and full transaction history; some customers also included Bitcoin transaction records. Revolut stated the leak did not include facial biometric telemetry, only the selfie images themselves.

Impact Assessment

ZachXBT assessed the incident as likely targeted at high-net-worth customers. If so, risk exceeds ordinary identity theft: passports and selfies can pass stricter identity checks; full transaction history and wallet reference numbers can bind real identities to on-chain addresses, enabling extortion, impersonation, and offline threats. The incident also exposes a common process gap—financial institutions responding to law-enforcement or regulatory disclosure requests often over-rely on email domain authentication and lack independent verification of the request itself. Revolut is not unique; any institution that receives such requests faces the same technique.

Remediation

References