Revolut reveals social-engineering attack exposed customer data despite safeguards

Revolut has disclosed a social-engineering scam that led to the exposure of customer personal details, despite claims of system security and proactive response, highlighting vulnerabilities in fraud prevention measures.

Revolut has disclosed that a social-engineering attack led to the exposure of customer information after an unauthorised party used a legitimate government email domain to submit fraudulent requests, according to Bloomberg and TechCrunch. The British fintech said the incident affected a limited number of customers and that it had blocked the offending address once the scheme was identified.

The company said its own systems were not breached and customer funds were not put at risk. Revolut also said it had informed the relevant government agency, as well as financial regulators, law enforcement and data-protection authorities, and had contacted those affected directly to offer support.

According to the notification seen by TechCrunch, the exposed material included identity and contact details such as dates of birth, postal and email addresses, and telephone numbers. The same notice said the attackers may also have seen passports, driving licences, verification selfies, account statements and transaction histories, while reports from The Block and other outlets said Bitcoin transaction records were among the data exposed.

The episode underscores how fraudulent requests can bypass safeguards outside a firm’s core systems, even when the target is a regulated financial business. It also comes as PYMNTS Intelligence research suggests many companies are still underusing bank-connection data that could help flag fraud earlier, with fewer than half of surveyed firms using those links to generate real-time alerts despite a rise in attempted attacks.