Revolut victim of sophisticated identity theft scam

Phishing attempts are increasing, but it is rare for a bank to be a victim itself. Revolut was targeted by a “sophisticated identity theft scam,” she told Le Figaro this Monday, September 14, confirming information from the specialized site French Breaches. Deceived by what it thought was a legal request for customer information by a public administration, the bank passed personal information and sensitive documents to the hackers.

Like all banks, Revolut is regularly asked for information about its customers by law enforcement or administrations, as part of legal procedures. The hackers allegedly used “an email with the real domain name of a government agency,” making the request unsuspected because it came from a legitimate address. The neobank, however, ended up detecting this fraudulent request for information and “immediately blocked the address and alerted the government agency concerned” (whose name is not specified) as well as the police.

Revolut indicated that a “limited number” of its customers are affected, without further details, and ensures that they have been warned. The bank also did not detail the data transmitted, but some of the customers concerned shared the screenshot of the email received on social networks. Would thus be likely to have been transmitted to pirates, depending on the requests, the first and last names, date of birth, profession, postal address, email address or even telephone number. But also very sensitive data such as the copy of identity documents and the verification selfie provided when opening the account, as well as financial data such as IBAN, account opening date, transaction history, etc.

Customers concerned and notified by email are invited to exercise great caution. The information obtained by hackers could allow them to set up particularly elaborate phishing attempts or even to impersonate victims. Especially since all the data in the hackers' possession is so-called KYC data (for “know your customer”), that allows a bank to authenticate its customer during an exchange.

Accounts specializing in tracking cyberattacks have published screenshots on social networks of a Telegram channel in which hackers allegedly demand a ransom from Revolut. In the channel, several documents (selfies and identity papers) are shared as proof of possession of the stolen data, even if their authenticity and the link with the theft concerning the bank remain to be demonstrated at this stage. On