Revolut says customer data exposed through fake government email
Passports, selfies and financial transaction histories of some customers were revealed to a fraudster using a government agency domain.
Asanat Analysis — Why it matters
Revolut's data breach—facilitated by a fraudster exploiting a spoofed government email domain—highlights a critical vulnerability in KYC/AML verification workflows that extends beyond traditional fintech into crypto onboarding. The exposure of passports, selfies, and transaction histories represents exactly the identity and financial data that makes customer accounts targets for account takeover, money laundering, and regulatory manipulation. This incident signals that social engineering remains more effective than technical security when attackers target the human verification layer.
For the crypto sector, this matters because Revolut and similar neo-banks serve as on-ramp/off-ramp infrastructure for retail and institutional users moving between fiat and digital assets. A compromised customer database—especially with biometric and transaction data—creates downstream risk for DEX liquidity pools, custody providers, and exchanges that accept Revolut transfers. The breach also reinforces regulatory pressure on custodians and fintechs to implement additional verification steps (liveness detection, multi-factor auth, rate limiting on withdrawals), which increases operational friction but may slow the velocity of fraud propagation across the ecosystem.