Revolut handed over passports to a rogue account inside a real government domain

Domain authentication proves which domain a message left, not whether the person sending it was allowed to ask for anything. The account in this case sat inside the agency's own mail infrastructure, so the checks passed on their merits ^[16]. "The request came from an unauthorised email account sent directly using the official government agency's email domain," the notification said ^[3]. "As the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request" ^[4].

Revolut's notification says the disclosed data may also have included verification selfies, account statements and transaction histories ^[8]. CoinDesk and Crypto Times report that the transaction histories covered Bitcoin ^[9]. The crypto security researcher ZachXBT, who posted about the notification to affected customers, assessed that the incident appeared to be targeted at high-net-worth users ^[10]. That assessment is his; Revolut has not said who the requests named.

Nothing was hacked. No systems were compromised, no malware was used, and Revolut says its servers were not accessed by an outsider and that customer funds were unaffected ^[14]. The company blocked the email address, alerted the agency, notified law enforcement and reported the incident to financial regulators ^[13].

Customers had the notification on September 11, a day before the confirmation reported on September 12 ^[2][1][17]. The timing lands while Revolut is arguing for regulatory standing: it holds conditional U.S. approval to become a national bank, is reportedly weighing a $200 billion IPO, and serves 80 million customers ^[15].

Revolut declined to name the agency involved or say which country or market was affected ^[12]. Security Affairs notes that naming the mailbox would let other regulated platforms search their own legal-request logs for the same sender ^[19].