Definition
Fraud in which attackers submit fraudulent customer data requests appearing to originate from legitimate government agency email domains — via compromised or rogue accounts within official domain infrastructure — bypassing fintech compliance verification workflows.
Key Points
- 2026-09-12: revolut fulfilled requests carrying valid domain authentication credentials from unauthorized third-party account (2026-09-12-revolut-customer-data-breach)
- Not a system hack — attacker exploited trust in government email domains and weak requester verification
- Revolut discovered fraud by independently contacting government agency, which confirmed no legitimate request
- Exposed data may include passports, selfies, IBANs, full transaction histories; limited customer count undisclosed
Exact victim count and government agency involved not disclosed by Revolut. Avoid speculation.