Revolut hands over customer data after fake government request

Digital bank Revolut has been fooled into handing over detailed and highly sensitive customer data via a phishing attack that used a legitimate government email domain.

The company has emailed affected customers warning that a wide range of information may have been shared. This includes name, date of birth, postal and email addresses – but also identity documents such as passports or driver's licenses and the facial verification image that customers used to sign up.

What's more, account statements, including IBAN, account status, the date accounts were opened, wallet reference number, withdrawal records, and full transaction history, including Bitcoin, were also shared.

One Telegram user, ZachXBT, has suggested that the incident was targeted in particular at individuals with high net worth.

Internal systems and customer funds remain completely unaffected, the company said, and it has blocked the unauthorized email source and notified the appropriate authorities.

However, the leaked data will represent a treasure trove for scammers launching phishing attacks or using the identity information to attempt to open other financial accounts elsewhere.

The breach arose via fraudulent requests from an unauthorized email account created directly within an unnamed official government authority's domain infrastructure, according to Reuters. This meant that it carried valid domain-authentication credentials and therefore wasn't picked up as fraudulent.

"What makes this particularly worrying is that the requests came from a legitimate government email account, making them far harder to spot as a phishing email," said Jake Moore, global cybersecurity advisor at ESET.

"The threat actors were able to cleverly disguise themselves as a genuine organization and simply request the information from Revolut."

There's no information on exactly which government department – or, indeed, which government – was being impersonated, nor the purported reason for the request. It's possible, though, that other banks or cryptocurrency exchanges have been approached in the same way.

"Increasingly, cybercriminals don't need to break through the technical security controls of a final target if they can impersonate a trusted source," said Moore.

"The big lesson for organizations is that a genuine email address doesn't always mean a genuine request. Safeguards against this can apply, but need to be enforced in ways where sensitive data requests require verification through a separate trusted channel."

UK-based Revolut has more than 80 million customers around the world and operates as a bank in more than 30 countries, online rather than via physical branches. It recently received permission to set up as a national bank across the US, expected to launch during the first half of next year. It's also believed to be considering s a potential public listing that could value it at as much as $200 billion.

ITPro has approached Revolut for comment.