Revolut has confirmed it handed customer identity documents and transaction histories to an unauthorised third party that submitted fraudulent requests from a legitimate government agency email domain. The disclosure lands while the London fintech prepares an initial public offering reported at up to $200bn.
The breach was disclosed to affected customers by email and confirmed by a Revolut spokesperson on Saturday. The company described a "sophisticated external impersonation scam" in which a third party used a genuine government agency domain to request information.
The exposed data is unusually sensitive. It included dates of birth, postal and email addresses, phone numbers, and copies of identity documents such as passports and driving licences. Verification selfies, account statements and transaction histories may also have been handed over.
Revolut said a "limited" number of customers were affected but has not disclosed how many, whether the incident was confined to a single market, or which government agency's domain was spoofed. Crypto security researcher ZachXBT, who publicised the customer notification late on Friday, said the incident appeared targeted at high net worth users.
The company blocked the email address once the scam was identified and notified the relevant agency, law enforcement and regulators. It stated that its systems and customer funds were unaffected.
The timing matters for the cap table. Revolut priced a secondary share sale at $75bn in November and, according to reporting in April, is preparing an eventual initial public offering at up to $200bn, a mark that would make it one of the largest listings ever attempted by a European technology company.
The distance between those two numbers rests substantially on the regulatory and operational credibility Revolut has been accumulating. The fintech secured a full French banking licence earlier this year and has been building a Western European hub in Paris. Earlier this month the US Office of the Comptroller of the Currency granted conditional approval for a national bank, with a launch expected in the first half of 2027.
Revolut now serves more than 80 million customers and operates as a bank in over 30 countries, with recent expansions into India, Mexico, France and the UAE.
An impersonation scam that succeeded against a bank's own information request process is a governance question rather than a systems failure, and it is the kind of question institutional investors ask during an IPO roadshow. No regulator has announced an enforcement action.
For existing shareholders, including the employees and early backers who sold into the November secondary, the disclosure is a reminder that the run-up to a $200bn listing is priced in operational trust as much as in revenue.
Original source: TechCrunch — https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/
:max_bytes(150000):strip_icc()/GettyImages-10535138361-0fb67d6164144c0783d240a4ecd86515.jpg)
