Revolut Handed Scammers Your Passport Without Being Hacked At All

Nobody Broke In. Revolut Just Opened the Door.

Revolut's systems were not hacked. Nobody cracked the app, exploited a vulnerability, or intercepted your traffic. A criminal sent a fake government request from what looked like a real government email address, with valid authentication credentials, and Revolut handed over the data. That is the whole story. It is also the most important part.

When people hear "data breach," they picture a shadowy figure typing furiously at a terminal. The reality is often far more mundane and far harder to defend against. This kind of attack is called a fraudulent legal process request, or more bluntly, social engineering at the institutional level. Criminals impersonate law enforcement or government agencies and ask companies to hand over your data. Companies, under real legal obligation to comply with legitimate requests, do so. No malware. No exploit. Just a convincing email.

How Does This Attack Actually Work?

The attacker does not need to break anything. They need to know how law enforcement data requests work, obtain or spoof a credible email domain, and craft a request that looks routine. Many large technology and financial companies receive hundreds of such requests a month. The volume creates pressure to process them quickly. That is exactly the gap criminals exploit.

In Revolut's case, the fraudulent requests came from a real government email domain, complete with valid authentication credentials. This is not a typo in the sender address or a Gmail account pretending to be a government body. It means someone either compromised a government email account or found a way to generate legitimate-looking credentials from a real domain. Revolut had no obvious reason to doubt the request. It processed the requests, fulfilled them, and only discovered the fraud afterward. The company then blocked the fraudulent address, notified the real government agency, and alerted law enforcement and financial regulators.

What Got Exposed?

Revolut disclosed the breach on September 12, 2026. Approximately 680 customers received notifications. That number sounds small. The data involved is not small.

For the affected customers, the following information was handed to a criminal:

• Passport and driving licence copies
• Identity-verification selfies
• Home addresses
• Phone numbers and birthdates
• Full bank account numbers (IBANs)
• Complete transaction histories, including Bitcoin activity

This is the full stack of identity. A passport copy plus an IBAN plus a selfie is enough to impersonate you in many financial contexts. Transaction history is particularly sensitive. It reveals where you shop, who you pay, what you earn, and whether you hold cryptocurrency. That information has real value to fraudsters building targeted scams or selling profiles to others who will.

Revolut's core systems, mobile app, and customer funds were not touched. If you were not notified, your data was not part of this specific incident.

What Should You Do Right Now?

If Revolut notified you, treat your identity as actively at risk. Even if you were not notified, the following steps protect you in general and cost nothing.

1. File a credit freeze with all three major bureaus. A credit freeze is free, reversible, and prevents anyone from opening new credit in your name without your explicit unfreeze. Do this before anything else.

2. Enable two-factor authentication everywhere, starting with your bank and email. Use an authenticator app, not SMS. SMS can be intercepted through SIM-swapping attacks. An authenticator app cannot.

3. Consider passkeys where supported. Major platforms including Google, Apple, and Microsoft now support passkeys. They replace passwords entirely and are phishing-resistant by design.

4. Monitor your IBAN. If your full bank account number is out there, watch for unauthorized direct debits or any SEPA transactions you did not initiate. Report unfamiliar debits to Revolut immediately.

5. Check your email for suspicious login alerts or password reset requests. Criminals with your phone number and address may attempt SIM-swap attacks to take over your accounts.

6. Request data removal from data broker sites. Services like the national opt-out registries or manual data-broker removal requests help limit how far your information spreads once it leaks. This takes time but compounds over months.

7. Be especially alert to personalized scams. Anyone who contacts you and already knows your address, transaction history, or partial account details is not more legitimate because of it. That data is now in criminal hands.

The Deeper Problem

Revolut did everything technically right. Its app was secure. Its systems were not compromised. Its security team responded appropriately once the fraud was discovered. None of that prevented 680 people from having their passport and bank history handed to a criminal.

This is the uncomfortable reality of modern data security. Your safety is not just a function of the company's technical defenses. It depends on every employee, every process, every vendor, and every institution that touches your data. The weakest link is often a legitimate-looking email, a tired inbox processor, and a procedure that prioritizes compliance speed over verification depth.

What does it mean to trust a financial app with your passport? It means trusting that every government email they ever receive is real. That is not a reasonable thing to trust.

The answer is not to avoid fintech. It is to understand that "secure platform" and "safe data" are not the same thing, and to take the steps above as baseline hygiene rather than emergency responses.

Do this now:

• Freeze your credit (free, reversible)
• Switch to an authenticator app for 2FA
• Watch your IBAN for unauthorized transactions
• Be skeptical of anyone who already knows your details

Sources

• techcrunch.com
• bleepingcomputer.com