Revolut Alerts Customers to Data Breach from Fraudulent Requests

Fintech company Revolut has notified some of its customers that sensitive personal information, including copies of their passports and driving licenses, along with dates of birth, home addresses, email addresses, and phone numbers, were compromised and handed over to criminals. The company has not disclosed the number of affected individuals or their locations. Revolut serves approximately 3.4 million customers in Ireland. A spokesperson for Revolut stated that the company recently identified a sophisticated external impersonation scam. An unauthorized third party used a legitimate government agency email domain to submit fraudulent requests for customer information. Upon detection of the scam, Revolut immediately blocked the email address and informed the relevant government agency, as well as enforcement agencies and data protection regulators. The spokesperson emphasized that Revolut's systems and customer funds remain unaffected. The company has reached out directly to the limited number of impacted individuals to inform them and provide necessary support. Cybersecurity firm ESET Ireland clarified that this breach was not a typical hack, as the requests for data originated from a genuine government agency email domain and were treated as legitimate. ESET expressed concern not about the leak itself, but about the potential misuse of the leaked information. A password can be reset quickly, but a passport scan cannot. Scammers holding personal details such as date of birth, address, mobile number, and photo ID can pose as legitimate representatives, potentially leading to financial loss. George Foley, a cybersecurity specialist at ESET Ireland, warned that such calls could come from individuals claiming to be from Revolut's fraud team, using the personal information to gain trust. He advised that if customers receive such calls, they should hang up and contact Revolut directly through the app. ESET also cautioned that the stolen documents could be used to open accounts or apply for credit in someone else's name, which may not become apparent for months. Customers who received notifications from Revolut are encouraged to check their credit records with the Central Credit Register and consider replacing any affected documents if confirmed by Revolut.