Fintech company Revolut confirmed that sensitive customer data was exposed following a sophisticated impersonation scam. Fraudsters used a legitimate government agency email domain to bypass the firm's authentication checks and request private information.
The compromised data includes copies of passports, verification selfies, and full financial transaction histories. Revolut stated that the incident affected a limited number of individuals, who were notified of the breach on Friday.
Upon discovering the unauthorized access, the company blocked the fraudulent email address and alerted the relevant government agency, financial regulators, and law enforcement. Revolut emphasized that its internal systems and customer funds remain unaffected.
Crypto researcher ZachXBT suggested the attack was limited in scale and specifically targeted high-net-worth users. The incident has prompted criticism on social media regarding the risks associated with mandatory KYC data collection.
