- Revolut disclosed that it exposed sensitive user data in compliance with a fake government request.
- The company said its team fell for the scam because the entity “carried valid domain authentication credentials.”
- A cybersecurity expert suspects that the fraudulent actors likely targeted only the bank’s high-net-worth users.
Digital banking platform Revolut disclosed that a fake government request duped it into providing sensitive customer details to malicious actors. The company has already informed clients about the incident via email.
What Revolut Exposed to the Fraudsters
Over the weekend, a Revolut spokesperson confirmed to several news outlets that the company indeed sent a notice to customers. It admitted that a “sophisticated impersonation attack” tricked its team into providing the personal details of customers to a third-party entity.
The leaked information included full names, dates of birth, home addresses, phone numbers, email addresses, IBANs, account statements, transaction histories, passport copies, driver’s license snapshots, and verification selfies. The full transaction history also covered users’ Bitcoin (BTC) activity, exposing their wallet addresses to perpetrators.
Meanwhile, Revolut clarified that the compromised data didn’t include users’ biometric facial telemetry. Additionally, it highlighted that their passwords are safe.
Reason for Compliance
According to Revolut, “an unauthorized third party” used a legitimate government agency domain email in its ploy. It leveraged the platform to submit fraudulent requests for information.
The institution believed the email was legitimate because it “carried valid domain authentication credentials.” As a result, it released the customer information the culprits requested.
After discovering the fraud, the bank blocked the fake government entity. However, it was too late and had no way to undo the mishap.
Revolut notably refused to name the agency in question. Nonetheless, it assured that it is conducting an internal probe into the matter, alongside an official police investigation.
A Targeted Attack for Affluent Clients
The pseudonymous ZachXBT, a renowned independent cybersecurity sleuth, added a major piece to the puzzle. He claimed the incident is likely limited in size, and it seems to have focused only on high-net-worth users.
Regardless of the affected customers, exposing their personally identifiable information (PII) to scammers now puts them at risk of targeted phishing attacks. Malicious actors could use the data they collected from Revolut for more advanced social engineering campaigns, including but not limited to emails, text messages, or calls pretending to be from Revolut or other legitimate institutions, to gather more information that could give them access to victims’ bank accounts, online banking apps, and digital wallets.
