Revolut customers' data exposed in sophisticated impersonation scam

Hundreds of European customers of digital bank Revolut had their personal information handed over to hackers after they impersonated a government agency, the company said on Wednesday.

Revolut said it had identified a “sophisticated external impersonation scam” in which an unauthorised third party used an email address from a legitimate government agency domain to submit fraudulent requests for customer information.

According to the Financial Times, the attack was carried out by Italian hackers who used a compromised Italian government email account to pose as officials seeking customer information.

The hackers obtained data including customers’ addresses, verification photos, identity documents and information about bitcoin activity.

A source familiar with the matter said around 680 Revolut customers across several European countries were affected.

Revolut is a British company, but its European banking operations are legally based and licensed in Lithuania, with more than 50 million customers across Europe.

Revolut said its systems and customer funds were “unaffected” and that it had contacted those affected to inform them and provide support.

“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection and financial regulators,” Revolut said.

Britain’s data protection regulator, the Information Commissioner’s Office, confirmed that it had received a report about the incident and was assessing the information provided.

Europe's fintech unicorn

The incident comes as Revolut expands further into the global banking sector, more than a decade after it was founded in 2015 as a fintech start-up.

The company was valued at $115 billion (€98.7bn) in a secondary share sale in July.

It secured a long-awaited banking licence in its home market of the UK in March, lifting restrictions on its ability to compete with established retail banks, and bagged a full French banking licence in August.

This month, Revolut also secured conditional approval for a US banking licence, while on Tuesday it filed an application for a banking licence in Switzerland.

Revolut initially built its business around smartphone-based currency exchange and money transfers before expanding into a wider range of financial services.

It now has more than 80 million customers globally and is targeting 100 million customers across 100 countries.