Spoofed Government Email Tricked Revolut Into Sharing Passports and Bitcoin Histories

Revolut’s latest security stumble isn’t a system hack—it’s a process failure. A malicious actor used an email account on a real government domain to request customer data, and the fintech complied. When legal process verification leans on domain-level trust, one compromised inbox can become a master key.

Per a customer notice shared by ZachXBT, the exposed records covered the full KYC stack and on-ledger activity: - Identity and contact: full name, date of birth, occupation, address, email, phone - Documents and verification: passport or driver’s license scans and the submitted verification selfie - Financial and crypto data: account statements with IBAN and wallet reference numbers, withdrawal records, and complete transaction histories—including Bitcoin - Revolut said no biometric facial telemetry was disclosed

A company spokesperson called it a “sophisticated external impersonation scam,” confirming the request came from an unauthorized account hosted on a legitimate government agency domain. Revolut said only a limited number of customers were impacted, blocked the offending address, notified the agency, law enforcement, and regulators, and emphasized that its systems and customer funds were unaffected. The firm declined to name the agency or quantify the exposure.

ZachXBT noted the victims appear to skew toward high-net-worth users. That aligns with the growing “wrench attack” risk: if attackers can tie verified identities and precise Bitcoin flows to real people, physical coercion becomes a more attractive vector than malware. The backlash was swift. Several industry voices argued that rigid KYC regimes often create single points of failure without delivering commensurate public safety benefits; one high-profile user said the episode is a reminder that KYC has put many at risk with little upside.

This incident lands amid a broader pattern of data fragility around crypto users. A recent vendor breach at a hardware wallet maker reportedly widened to tens of thousands more records, and a social platform incident triggered waves of unexpected password resets. Revolut itself is building deeper crypto rails—launching a euro-pegged EURR stablecoin this year—and weighing an IPO. Trust is a precondition for both.

The core issue here is not email spoofing—it’s institutional trust design for legal data requests. Many compliance teams still treat messages that pass SPF/DKIM/DMARC from a government domain as sufficient proof of authority. That model breaks under modern threat realities: credential reuse by insiders or contractors, compromised mailboxes, and unauthorized sub-accounts on federated domains are common. You don’t need to breach Revolut to exfiltrate its data if you can masquerade as the sheriff.

There is a cleaner approach: - Cryptographically signed requests: pre-exchanged keys between vetted agencies and regulated entities; no signature, no data - Out-of-band callbacks: mandatory voice verification to a known switchboard and case cross-check before fulfillment - Dedicated portals with mutual TLS and per-request attestations tied to docket numbers and expiration windows - Principle-of-minimization: fulfill only the precise fields requested; segment KYC images from transactional logs with separate access controls and audit trails - Kill switches: immediate global suppression of a sender upon anomaly detection, with automated retrospective alerts to any potentially impacted users

This is not anti-regulatory; it’s pro-operational rigor. Proper attestation protects agencies from impersonation and protects platforms from exactly this type of breach. Firms that implement these controls usually see a sharp drop in both false positives and fulfillment latency because the process becomes standardized instead of ad hoc.

For users, a few guardrails help: - Trim your footprint: periodically request deletion of outdated documents where policy allows; limit exportable statements in your inbox - Diversify custody: avoid tying large balances to a single KYC identity on a single platform - Privacy hygiene: use fresh addresses, avoid public reuse, and keep on-chain heuristics from trivially mapping to your name - Physical security planning: if you’re public about holdings, treat travel, home security, and device access as part of your crypto stack

Revolut will probably tighten its legal process intake now. The larger lesson extends to every VASP, exchange, and fintech handling crypto data: if your compliance pipeline treats a domain as identity, you’ve left the back door ajar for anyone with a borrowed badge.