Revolut's Security Fail: Fake Government Request Exposed User Passports and Bitcoin Histories

Revolut has a serious problem on its hands. The London-based fintech giant handed over sensitive user data—including passport scans and complete cryptocurrency transaction histories—after receiving what turned out to be a fraudulent information request allegedly spoofed from a government agency's legitimate email domain.

Here's what happened: Someone impersonated a government entity by using an official government email address to request user information. Revolut, apparently without proper verification protocols, complied. The breach exposed identity documents and full crypto trading records for what the company describes as a "limited" number of users—though they've been vague about the actual scope.

This is a critical failure in data security and due diligence. Government requests for user information typically follow strict legal channels and procedures. Legitimate agencies don't just fire off emails and expect immediate compliance. The fact that Revolut fulfilled this request without authenticating the sender or following standard verification procedures raises serious questions about their operational security.

The Crypto Transaction Exposure Problem

For crypto portfolio holders and traders, this is particularly concerning. The leaked data included full cryptocurrency transaction histories—meaning bad actors now have detailed records of who transacted what, when, and potentially where assets moved. In the crypto space, transaction history is sensitive intel. Combined with passport data, this creates a sophisticated dossing opportunity for targeted attacks, scams, or theft attempts.

Revolut's crypto offering has attracted millions of users looking for easy access to Bitcoin, Ethereum, and other digital assets. But this incident exposes a fundamental weakness: the company's ability to protect that sensitive financial data remains questionable.

What This Means for Users

If you're a Revolut user with crypto holdings or active trading history, here's the reality: your transaction patterns and identity documents may have been compromised. The company hasn't disclosed exact numbers, but they're claiming the exposure was limited. That's cold comfort when sophisticated threat actors have your personal ID and complete trading activity.

The incident also raises broader questions about Revolut's compliance infrastructure. A robust verification process should catch spoofed government requests immediately. That it didn't suggests gaps in their security architecture that could affect other types of requests or attacks.

The Regulatory Fallout

This won't go unnoticed by regulators, especially in the EU where Revolut operates under a banking license. Data protection authorities take breaches seriously, and this one involves both personal identity documents and financial trading data—two of the most sensitive categories under GDPR and similar frameworks.

Revolut has likely triggered mandatory breach notification requirements and will face scrutiny over their incident response and the controls that allowed this to happen in the first place.