Fake Government Domain Tricked Revolut Into Leaking Crypto Customer Data

A single fraudulent request built around a real government domain was all it took to convince Revolut to hand over sensitive customer records, including passport copies, selfie photos and bitcoin transaction history. The case, reported September 14, 2026, exposes how a fintech platform that blends traditional banking with cryptocurrency trading can be undone not by sophisticated hacking, but by a well-disguised email.

Revolut markets itself as a hybrid platform: a banking app that also lets users buy, sell and hold cryptocurrencies. That combination is precisely what makes this incident more consequential than a typical data leak. When a breach hits a pure crypto exchange, the exposure is usually limited to trading activity and wallet addresses. When it hits a company like Revolut, the fallout links identity documents, biometric selfies and financial history to blockchain transaction records tied to real, named individuals.

How a Fake Request Slipped Through

According to the facts disclosed, the mechanism was strikingly simple: someone submitted a request for customer data using a domain designed to look like it belonged to a government authority. Revolut’s internal verification process failed to catch the impersonation, and the company released documents that included passport scans, selfie photographs used for identity verification, and records of customers’ bitcoin transactions.

This is not a case of encryption being broken or servers being infiltrated. It is a case of process failure — the kind of vulnerability that exists at the intersection of compliance obligations and operational trust. Financial institutions routinely receive legitimate requests from regulators and law enforcement, and they are generally expected to respond promptly. That expectation, built to support legal cooperation, becomes a liability the moment a bad actor learns to imitate the appearance of authority convincingly enough.

Coverage of this episode has already circulated under several headlines describing how Revolut was tricked into leaking customer data via a fake regulator request, and other reporting has focused specifically on how the incident exposed customer bitcoin data to a fake government agency. Together, these accounts point to the same underlying weakness: a verification protocol that trusted a domain name over deeper authentication.

What This Means for Crypto Users

For customers who use Revolut’s crypto features, the exposure is layered in a way that amplifies the risk. A leaked passport copy is a serious problem on its own, enabling identity theft or fraud. Add a selfie photo, and the exposure becomes usable for bypassing other platforms’ biometric verification. Add bitcoin transaction history, and outside actors gain insight into a person’s holdings and trading patterns — information that has historically been used to target crypto holders for scams, phishing or even physical extortion attempts.

The incident also raises a broader governance question that extends beyond Revolut. Any company sitting at the intersection of finance and crypto now holds a dual-purpose dataset: identity documents required by know-your-customer rules, and blockchain activity that was supposed to offer some degree of separation between real-world identity and on-chain behavior. When both are stored and released together, the privacy protections that crypto users often assume — pseudonymity, at minimum — collapse entirely.

Separate reporting has already framed this as a lesson in how fake regulator emails can beat KYC checks that were designed to keep bad actors out, not to filter deceptive requests coming from what looks like inside the regulatory system itself. That distinction matters: KYC protocols are built to verify who a customer is, not to verify who is asking for a customer’s data.

What Comes Next

Several concrete developments are worth tracking as this story unfolds:

• Whether Revolut discloses how many customers were affected and what specific categories of data were released beyond passports, selfies and transaction history.
• Whether financial regulators in the jurisdictions where Revolut operates require or recommend stricter domain and identity verification for law-enforcement and regulatory data requests.
• Whether other exchanges and neobanks with combined crypto-banking services audit their own request-verification workflows in response.
• How this incident interacts with tightening cybersecurity rules elsewhere in the industry, such as the EU’s new requirements that are forcing crypto wallet makers into 24-hour breach alerts, which signal a regulatory environment increasingly focused on rapid disclosure and accountability.

The episode is a reminder that as financial platforms increasingly bundle traditional identity verification with crypto activity, the attack surface is not only technical but procedural. A convincing domain name proved more effective than any exploit, and that should prompt scrutiny of how data-request verification is handled industry-wide, not just at Revolut.

Source: CriptoNoticias

This content is for informational purposes only and does not constitute financial or investment advice.