Revolut Exposes Bitcoin Activity and Passports After Falling for Fake Government Request

The digital bank handed over sensitive customer data including passports, selfies, home addresses and Bitcoin transaction details after treating a fraudulent government request as legitimate, though no funds were stolen.

Revolut, the London-based digital bank with over 40 million users globally, has confirmed a significant data breach after falling victim to a sophisticated social engineering attack. The company mistakenly processed what appeared to be a legitimate government data request, handing over highly sensitive customer information to fraudsters posing as law enforcement officials.

The exposed data includes passport copies, selfie verification photos, home addresses, and critically for crypto users, detailed records of Bitcoin activity on the platform. The breach affects an undisclosed number of customers, though Revolut has emphasized that no customer funds were compromised or stolen during the incident. The company detected the fraudulent request after the data had already been transmitted.

This breach highlights a growing vulnerability in the crypto and fintech ecosystem: the exploitation of legal data request processes. Financial institutions are legally obligated to respond to government and law enforcement requests, creating a potential attack vector when criminals successfully impersonate authorities. The inclusion of Bitcoin transaction data is particularly concerning, as it could enable targeted phishing campaigns or physical security threats against customers known to hold cryptocurrency.

Revolut has not disclosed the specific mechanism used by the attackers to authenticate their fake request, nor the jurisdiction they claimed to represent. Industry experts suggest the attackers likely forged official letterhead, used compromised government email addresses, or exploited gaps in the verification procedures that banks use to authenticate law enforcement requests. The sophistication required suggests an organized criminal operation rather than opportunistic hackers.

For affected customers, the exposure of passport data combined with cryptocurrency activity creates multiple risks. Identity theft becomes easier with verified identity documents, while knowledge of Bitcoin holdings makes individuals targets for SIM-swap attacks, phishing attempts, or even physical threats. Security researchers recommend affected users enable additional authentication layers, monitor credit reports, and consider changing addresses associated with high-value crypto holdings.

The incident comes at a sensitive time for Revolut, which has been pursuing banking licenses in multiple jurisdictions and faces increased regulatory scrutiny over its rapid growth and compliance practices. The company processes billions in crypto transactions annually and positions itself as a bridge between traditional banking and digital assets. This breach may prompt regulators to examine how fintech firms verify and respond to government data requests.

Revolut stated it has reported the incident to relevant data protection authorities and law enforcement agencies, and is implementing additional verification steps for future government requests. The company is directly notifying affected customers and offering credit monitoring services. Industry observers note that similar social engineering attacks targeting the data request process have affected other financial institutions, suggesting this may represent an emerging threat vector across the sector rather than an isolated incident at one company.