British fintech company Revolut has confirmed that sensitive customer information was shared with an unauthorized third party after the company received fraudulent information requests sent from an email domain belonging to a legitimate government agency.
According to a notification emailed to affected customers and reviewed by TechCrunch, the exposed information included customers’ identity and contact details. This could include dates of birth, postal and email addresses, phone numbers, and copies of identity documents such as passports and driver’s licenses. Revolut also said the information may have included verification selfies, account statements, and transaction histories.
A Revolut spokesperson confirmed that a “limited” number of customers were affected and said the company had contacted those individuals directly. However, Revolut did not reveal the precise number of customers involved. The fintech also did not clarify whether the incident was restricted to a particular market and declined to identify the government agency whose email domain was used in the fraudulent requests.
“Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information,” the spokesperson said.
After identifying the scam, Revolut said it blocked the email address used by the unauthorized party and notified the relevant government agency, law enforcement authorities, and applicable regulators. The company also emphasized that its own systems and customer funds were not affected.
London-based Revolut has more than 80 million customers worldwide and operates as a bank in more than 30 countries, according to information on its website. The fintech has recently expanded its presence in several markets, including India, Mexico, France, and the United Arab Emirates. Earlier this month, the U.S. Office of the Comptroller of the Currency granted Revolut conditional approval to establish a national bank in the United States. The company expects to launch its U.S. banking operation during the first half of 2027.
Crypto security researcher ZachXBT also highlighted the incident late Friday after posting about the email Revolut sent to affected customers. The researcher said the breach appeared to have specifically targeted high-net-worth users.
The disclosure comes as Revolut reportedly considers a potential public listing that could give the company a valuation of as much as $200 billion. That would represent a significant increase from its $75 billion private valuation in November. At the same time, the fintech has continued expanding its banking operations across Europe and other global markets, obtaining banking licenses in France and the United Kingdom in recent months.
