The UK-based digital bank reportedly disclosed sensitive customer information after receiving requests from a government agency email domain
London-based fintech company Revolut disclosed sensitive customer information to scammers after receiving fraudulent requests sent from a “legitimate government agency email domain,” according to media reports on Saturday.
The exposed data included customers’ birth dates, phone numbers, postal and email addresses, as well as copies of passports and driver’s licenses, according to a notification Revolut sent to affected clients and cited by the online newspaper TechCrunch. The compromised data may also have included verification selfies, account statements, and transaction histories, according to the report.
Revolut confirmed the breach to both TechCrunch and Reuters, saying a “limited” number of customers had been affected by a “sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information.”
Co-founded by Russian-born entrepreneur Nik Storonsky in 2015, Revolut describes itself as the “world’s first truly global bank,” which provides digital banking services to more than 80 million customers worldwide.
The incident comes as Revolut has been rapidly expanding internationally. A little over a month ago, it was granted a banking license in France, while the company has also been expanding its presence in markets including India, Mexico, and the UAE. Last week, the US Office of the Comptroller of the Currency issued a conditional approval to Revolut, allowing it to set up a bank in the country.
Late last month, police on the British island of Jersey warned Revolut users of an uptick in fraud cases, where the victims had received a telephone call from scammers posing as Revolut support or security teams.
Several countries have also taken issue with the company’s practices in recent years. In April, Italian authorities slapped the online bank with fines totaling €11.5 million ($13.25 million) over alleged unfair commercial practices. Last year, the central bank of Lithuania fined Revolut €3.5 million, accusing it of failing to comply with money laundering prevention regulations.
