Revolut gave out customer passports to a spoofed government email
Revolut confirmed it disclosed customer data after complying with what it believed was a genuine government demand. The request came from an unauthorised account on the agency's official domain and carried valid domain authentication, so it passed every technical check. The disclosed data included full names, dates of birth, occupations, addresses, passport or driving licence copies, verification selfies, account statements, IBANs and full transaction histories including Bitcoin activity. Revolut told TechCrunch a limited number of customers were affected; investigator ZachXBT, who amplified the customer notice first shared by Mark Karpelès on X, says the requests appear targeted at high-net-worth users. Funds are safe and Revolut has not named the agency.