The Revolut Data Breach Wasn't a Hack. That's the Worrying Part.
On Friday evening the crypto investigator ZachXBT posted a Revolut customer notification to Telegram. By Saturday Revolut had confirmed it. Someone had sent the company fraudulent requests for customer information from an email address on a genuine government agency's domain, and Revolut had answered them.
Nothing was broken into. No password was stolen. What makes the Revolut data breach unusual is that the request looked entirely legitimate. Revolut's notification to affected customers puts it plainly: because the email “carried valid domain authentication credentials”, it “was fulfilled under the reasonable belief that it was an authentic government agency request”. The email was real. The request wasn't.
What the Revolut data breach exposed
Revolut has described the number of people affected only as limited, and hasn't given a figure. What went out is the part worth sitting with.
That isn't a data leak in the usual sense of an email list going astray. It's an identity kit. Everything someone needs to convincingly be you, in one file, already assembled and already verified by a regulated firm.
The part that costs businesses money
For a private individual the passport copy and the selfie are the obvious worry. For a business, the transaction history is worse.
Who you pay. How much. How often. Which week of the month. Which country. That's the blueprint for invoice interception fraud, where a supplier's bank details are quietly altered on a genuine-looking invoice and a payment you were always going to make lands somewhere else. That fraud works on plausibility, and nothing makes a fake invoice more plausible than knowing exactly what your real ones look like. And once a payment has gone, the mechanics of getting it back are a good deal less straightforward than the mechanics of sending it.
You don't need money taken from your account for a breach to cost you. You need someone to know enough about your payments to write a convincing email.
Revolut's position, and the uncomfortable bit
Revolut says its systems and customer funds are unaffected, that it blocked the address as soon as it spotted the problem, and that it alerted the agency concerned along with law enforcement, data protection and financial regulators. It calls the incident a sophisticated external impersonation scam. On the face of it those are the right steps in the right order.
The uncomfortable bit, for everyone else in this industry including us, is that the control which failed wasn't technical. Somebody at a financial firm received what looked in every verifiable respect like a legitimate government request, and did what firms are supposed to do when they get one. Any firm can be on the wrong end of that. Anyone claiming otherwise is selling something.
What you can actually do about it
Revolut says it has contacted affected customers directly. If you've had that email, or if you've simply decided your details are floating about somewhere and you'd rather they were harder to use, there are four things worth doing. None of them takes long.
Put a flag on your name. Cifas Protective Registration costs £30 and lasts two years. It places a warning against your details in the National Fraud Database, so any organisation using Cifas data is prompted to run extra checks when someone applies for a product in your name. It doesn't affect your credit score. It does mean your own genuine applications take slightly longer while those checks happen, which is the trade-off and it's a fair one. Cifas says it works best in the first few months after your data goes astray, so the window is now. Applications are online only, they won't take one over the phone.
If you'd rather not pay, ask the credit reference agencies to add a Notice of Correction password to your file. Lenders have to ask for that password before granting credit in your name, including to you. It's free, it's clunkier, and it's a great deal better than nothing.
Then assume the next approach is a convincing one. Whoever has this data knows your name, your address, your date of birth, your occupation and what your account activity looks like. A caller quoting real details back at you is not thereby genuine. That is precisely what the file is for. If someone rings claiming to be your bank's fraud team, hang up and call back on the number printed on your card, from a different phone if you have one to hand.
And report anything that actually happens. Action Fraud was retired in December 2025 and replaced by Report Fraud, run by the City of London Police, at reportfraud.police.uk or on 0300 123 2040, covering England, Wales and Northern Ireland. In Scotland it's Police Scotland on 101. There's a free victim support line on 0808 1689 111.
One thing nobody can fix. A leaked copy of a passport isn't a lost passport, and the official guidance only covers documents that have been lost or stolen. You can't un-leak a scan. Which is exactly why the question of how long a firm keeps that scan in the first place is worth asking.
What to ask your provider
Three questions, and they're worth putting to whoever holds your money, us included.
Who is authorised to release my data, and what do they check before they do it? Specifically, is there a second pair of eyes on a request like this, or can one person acting entirely in good faith send the file out on their own?
Does anyone call back on a number you already hold, rather than replying to the address that made the request? Callback verification is unglamorous and it's the control that would have caught this one.
How long is the identity file kept after onboarding, and can any of it be deleted once it's served its purpose? A document you no longer hold can't be handed to anybody.
And for your own payments, the boring control that works: verify every change of supplier bank details by phone, on a number you already had, never the one printed on the new invoice. If you run a business, tell whoever pays your invoices to do the same. It's tedious. It also stops most of this.
Where we sit
We hold the same categories of data on our clients that any regulated provider does, because the rules require it. Being a small firm doesn't make us safer by default. What it does mean is that the person who'd field a request like that knows our clients by name, so an unexpected government demand for a named client's file reads as odd rather than routine. That's a human control, not a technical one, and human controls fail too. We'd rather tell you what the control is than pretend it can't.
The lesson here isn't that Revolut got it wrong. It's that the attacker never had to break anything. They asked, from an address that checked out.
Get in touch
If you want to know exactly who holds your data and what it would take to release it, ask us. We'll tell you straight.
Pathfinder FX
1 Knights Court, Archers Way, Battlefield Enterprise Park, Shrewsbury, SY1 3GA
+44 (0)1743 290955
Comments