Revolut exposes customer data in fake government email scam

No server intrusion, no drained balances, no sensational zero-day exploit.
Revolut voluntarily handed over customer records because an email originated from a legitimate government domain.
This represents the price extracted for perpetual identification data collection.
TechCrunch secured confirmation from the firm, writes Dr. Peter F. Mayer.
Once again, the fallout of persistent surveillance enforced by governments and regulatory authorities becomes glaringly visible.
British neobank Revolut released sensitive customer records, encompassing passport scans, driver's licenses, biometric verification selfies, residential addresses, account credentials, and comprehensive transaction logs, including Bitcoin, to an unauthorized third party.
The catalyst: a fraudulent request originating from a legitimate government domain that passed standard technical authentication checks (SPF, DKIM, DMARC). Additional reporting can be reviewed at Reclaim The Net, TechCrunch, and Reuters.
Revolut itself characterizes the episode as «advanced identity fraud».
The enterprise acted «under the reasonable belief» that it was processing an authentic government directive.
They subsequently recognized their error, blacklisted the address, and reported the incident. They assert that only a «limited» volume of clients was affected.
Internal systems and client capital remained untouched.
Nevertheless, formal notices transmitted to impacted individuals outline an exhaustive inventory of disclosed records: full names, birthdates, professions, home addresses, contact telephone numbers, identification document scans, verification selfies, banking movements, and entire transaction ledgers, including cryptocurrencies.

The authentic problem

This incident did not constitute an isolated operational mishap.
It is the logical consequence of a regulatory architecture compelling enterprises to warehouse increasingly sensitive personal records belonging to users across prolonged retention windows.
«Know Your Customer» (KYC) and «Anti-Money Laundering» (AML) mandates dictate precisely this protocol.
The privacy policy of Revolut in the UK makes this explicit: personal records belonging to British clients are routinely retained for up to seven years following the termination of a commercial relationship, occasionally longer «for statutory requirements».
Closing an account does not ensure that archived identity scans or verification selfies are purged from corporate servers.
This exact data concentration renders security breaches profoundly hazardous.
Once exposed, such material can be weaponized for identity theft, precision phishing, and synthetic profiling, even if capital balances were never breached in the initial event.
Archived passport scans or verification photographs do not simply vanish.

The fallout extends beyond fintech

An identical dynamic is visible outside the financial technology sector.
In 2025, following a security breach at an external customer service contractor, Discord compromised the identity credentials of roughly 70,000 users, files originally gathered to verify user age in dispute investigations.
The identical baseline operates here: highly sensitive identity assets are amassed, stored, and consequently generate vulnerabilities, whether through technical intrusions or, as demonstrated with Revolut, through cleverly spoofed official transmissions.
The more corporations are mandated by statutory decree or regulatory oversight to maintain identity dossiers, facial verification selfies, and transaction logs, the broader the systemic attack surface expands.
This reality makes administrative pressure pushing for expanded digital identity verification (regulating online access to standard services) exceptionally dangerous. Every supplementary mandate to scan and archive identification documents multiplies avenues for exploitation.

The true cost of surveillance

Revolut was not breached by hackers. No intruder compromised its core technical architecture.
The banking platform released the dossiers voluntarily because the operational framework was engineered to process government demands as seamlessly as possible.
Authentication standards verify the technical routing origin of a transmission, not the substantive legality of its content.
Once legitimate domain credentials are exploited, spoofing yields an effective attack vector.
This does not represent a technical footnote; it reflects a structural flaw.
The policy agitation demanding «enhanced oversight» and «secure identity verification» ultimately constructs centralized databases that subsequently leak, face internal mismanagement, or, as demonstrated in this instance, fall into unauthorized custody.
Entities perpetually aggregating government identification credentials and biometric selfies cannot express shock over the resulting fallout.
The Revolut precedent serves as an unambiguous warning: the cost of perpetual identity verification is not theoretical. It materializes as physical passport scans, verification selfies, and transaction archives held by unauthorized actors.
There is nothing left to add to Pepijn's analysis; the facts speak for themselves:

Het kabinet “verwelkomt” de leeftijdsverificatie die de EU gaat invoeren. Hiervoor zal de EU de “Europese digitale identiteit” gebruiken waar de Tweede Kamer in meerderheid TEGEN heeft gestemd maar die TOCH is ingevoerd. “Iedere gebruiker” moet zich straks dus gaan identificeren. https://t.co/IKkbdmo56t

— Pepijn van Houwelingen (@PvanHouwelingen) September 14, 2026