Revolut victim of a scam: hackers use emails from Italian law enforcement agencies

The cyber police have started investigations for unauthorized access to the computer system and computer fraud. The hackers would have used an official certified mail address of the Italian police to request and obtain all the data: from residence to passport, up to current accounts and bank movements

The hackers who defrauded Revolut used a compromised institutional email belonging to an Italian institution. By doing so, hiding behind a legitimate government agency email domain, cybercriminals managed to gain access to the personal data of almost 700 customers of the UK banking services company. The cyber police have opened an investigation into unauthorized access to the computer system and computer fraud and are working to trace those responsible.

The data of 680 customers was stolen

Confirming "a sophisticated external impersonation scam, in which an unauthorized third party used an email address belonging to a legitimate domain of a government agency to submit fraudulent requests for information", was the British fintech itself, born as a startup for digital payments and now a direct competitor of the largest European banks. Cybercriminals, in essence, managed to ask for and obtain sensitive information that was disclosed to an unauthorized third party. This involves passport data, residential addresses but above all bank accounts and economic transactions carried out by customers: approximately 680 according to what was announced by the company. But, says a spokesperson, “Revolut systems and customer funds were untouched.”

Used certified address of the Italian police forces

Revolut said it acted immediately when it noticed the hack. "As soon as the fraud was identified - explained a company spokesperson - we immediately blocked the address and informed the relevant government agency, as well as law enforcement authorities, data protection authorities and financial supervisory authorities". Furthermore, he added, "the limited number of people involved were directly contacted to inform them of the incident and provide them with assistance". As explained by the company, the hackers did not need to hack the servers or overcome complex IT barriers: it was sufficient to use an official certified email address of the Italian law enforcement agencies that had previously been hacked to obtain all the desired data from the bank, pretending they were necessary for an international investigation.

Financial institutions required to provide data to law enforcement and government agencies

The criminals would have worked on the attack for many months, taking advantage of the obligation to which all financial institutions are subject to provide law enforcement and government bodies with all the information necessary for any investigations or official dossiers. As reiterated by the Revolut spokesperson, “requests from verified government domain addresses are processed as mandatory legal requests”. In this case, they added from the UK company, “as the requests contained valid technical authentication of the domain, they were met as standard legal compliance with the reasonable expectation that this was a genuine agency investigation.”