Revolut handed identity files and Bitcoin histories to an email that passed SPF, DKIM and DMARC

SPF confirms a message came from a server the domain authorized, DKIM confirms nobody altered it in transit, and DMARC ties the two together and tells the recipient what to do if either check fails ^[6][7][8]. All three passed. Whether the sender was entitled to a customer's identity file is a fourth question, and none of the three checks tests it ^[16]. The only thing that answers it is an outbound call to a number the agency itself published, which is slow and manual.

Revolut says no passwords, PINs or private keys were compromised and no customer funds moved ^[9]. What left instead was the onboarding file: the selfie, the date of birth, the IBAN, the withdrawal history ^[3]. A date of birth cannot be reissued the way a password can.

Cryptobriefing, which reported the notifications, describes no verification step Revolut applied beyond the email checks. It calls the failure a compliance protocol vulnerability: the target was the workflow for answering official government data requests ^[12].

Revolut is a British fintech eyeing a $200 billion valuation and a banking license ^[2]. It has been exploring a listing at around that figure, and the license approval turns on scrutiny of exactly these operational controls ^[13]. The company has not sized remediation spending. The near-term cost is attention: the compliance and legal staff preparing for supervisory review have to document and rebuild a request-handling procedure while the application is live, and they are not spending that time on the application itself.

One version: the affected group really is small, supervisors treat it as one employee's misjudgement, and the license timetable moves as planned. In the second, the count surfaces through customers publishing their notification letters. That is how the incident became public in the first place, including through people known in the crypto industry ^[11]. And it turns out larger than the word Revolut used. The third and more interesting version is that other regulated firms received the same request from the same domain and have not said so.

I would weight the second and third above the first, because the attack cost one email and touched none of Revolut's internal systems ^[15], and the counter-measure costs one phone call. A supervisor comparing a cheap attack against a cheap control that was absent is assessing judgement.

I would change my mind if Revolut publishes a customer count in the tens and can show an out-of-band verification step that existed on paper and was skipped by one person. That would make this a staffing failure inside a documented control, and the licensing case weakens considerably. The company described the affected population only as "limited" ^[10].