Revolut gave out customer passports to a spoofed government email
Revolut confirmed it disclosed customer data after complying with what it believed was a genuine government demand. The request came from an unauthorised account on the agency's official domain and carried valid domain authentication, so it passed every technical check. The disclosed data included full names, dates of birth, occupations, addresses, passport or driving licence copies, verification selfies, account statements, IBANs and full transaction histories including Bitcoin activity. The exposure appears limited and aimed at higher-net-worth customers; funds are safe and Revolut has not named the agency.