Revolut Shared Customer Data With Imposters After Security Lapse

Fintech firm Revolut has disclosed that it shared customer information with individuals posing as a government authority. The company stated that the fraudulent requests passed its internal checks before the impersonation was discovered. Revolut has notified affected customers and regulators, assuring that client funds remain secure, though the number of impacted individuals was not released.

The exposed data could include identification documents, addresses, contact details, identity verification photos, and account transaction information, with the scope varying per customer. The incident highlights a failure in verifying authorization for information requests, allowing unauthorized parties to obtain sensitive customer documents held by the company.

Revolut emphasized that while account balances may remain untouched, the compromised personal and financial data poses a significant risk. Imposters can leverage this information to appear more credible in future communications, potentially tricking customers into making detrimental transactions or revealing sensitive details like passwords or codes. Even changing account passwords does not negate the risk associated with previously exposed data like birthdates or addresses.

The article also references a separate case in Israel where an individual, whose identity was stolen, faced a tax assessment of approximately half a million shekels, illustrating the prolonged and complex aftermath of identity misuse beyond immediate financial loss.

Revolut's own security guidance acknowledges that impersonators may possess prior knowledge of customer details. The incident raises questions about how financial institutions verify the legitimacy of information requests. Customers are advised to be cautious of suspicious communications and to independently verify any concerns through official channels, such as the company's app or known customer service numbers, rather than relying on information provided by the potential impersonator.

The company is undertaking an internal review, which includes examining the incident, addressing customer concerns, identifying the specific documents shared, and improving its security protocols. The full financial and reputational costs for Revolut, as well as the extent to which customers might alter their behavior, remain uncertain.