Revolut has confirmed that sensitive customer information, including copies of passports and driving licences, has been obtained by an unauthorised third party after fraudulent information requests were sent from a legitimate government agency email domain.

The compromised information may also have included customers’ dates of birth, postal and email addresses and phone numbers, verification selfies, account statements and transaction histories.

The London-based fintech said it had alerted the relevant government agency, law enforcement bodies, data protection authorities and financial regulators after detecting the incident.

The incident highlights the risks posed by social engineering attacks in which criminals exploit trusted identities and legitimate communication channels rather than directly compromising technical systems.

Subhalakshmi Ganapathy, chief IT security evangelist at ManageEngine, said the incident demonstrates the distinction between verifying information and authenticating the person or organisation behind a request.

"The Revolut incident is a reminder that verification is not the same as authentication. The attack worked not by breaking the technology, but by exploiting trust: the attacker simply wore the uniform of a government agency, and a legitimate-looking domain with an official tone was enough to walk past defences built to stop code, not con artists.

"That matters because customer data rarely stays where it is stolen. Identity documents and transaction histories are the raw material for the next wave of fraud, which means a breach like this isn't a closed incident for the customers affected; it's fuel for the ones to come. The cost of failing to verify a single inbound request compounds across every downstream attack it enables."

Revolut has more than 80m customers globally and operates as a bank in more than 30 countries. The fintech is understood to be considering an IPO, potentially in 2027 or 2028.

Revolut Bank UK Ltd officially launched as a fully licensed UK bank in March 2026 after restrictions on its mobilisation-stage banking licence, originally granted in July 2024, were lifted.

---