ZachXBT: Revolut Suspected of Leaking Data of Some High-Net-Worth Users Due to Trusting a Forged Government Request

On his personal channel, blockchain investigator ZachXBT stated that fintech firm Revolut allegedly failed to detect a forged government agency request, leading to the leakage of some users’ personal identifiable information (PII). According to his disclosure, Revolut received a customer information retrieval request that appeared to come from a legitimate government agency, sent via the agency’s official email domain. Since the email had valid domain authentication details, Revolut deemed the request authentic and responded. The potentially involved data includes users’ names, dates of birth, occupations, addresses, emails, phone numbers, as well as copies of passports or driver’s licenses, identity verification selfies, account statements, IBANs, withdrawal records, and full transaction histories—including Bitcoin transactions. In its notification to users, Revolut said no biometric facial telemetry data was leaked. ZachXBT noted that the incident’s scale may be limited, but it appears to target primarily high-net-worth users. Multiple Revolut users received alerts about the security incident yesterday. Revolut officials have previously reminded users to verify suspicious communications via in-app customer service and avoid providing personal or financial information.