Revolut customer data breach after fake govt requests

Fintech company Revolut has told some of its customers that copies of their passports and driving licences, along with their dates of birth, home addresses, email addresses and phone numbers, were handed to criminals.

The company has not said how many people were affected by the breach, or where they live.

Revolut has about 3.4 million customers in Ireland.

"Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information," a Revolut spokesperson said.

"Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators," the spokesperson added.

"Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support," they added.

Cybersecurity firm ESET Ireland said the Revolut breach was not a hack in the usual sense as the requests for the data came from a genuine government agency email domain and were dealt with as genuine.

ESET Ireland said it is not worried about the leak itself, but what the leaked material is used for.

"A password gets reset in a minute. A passport scan does not, and a scammer who holds someone's date of birth, address, mobile number and photo ID can make a phone call that sounds completely legitimate, because every detail they quote is right," it said.

"The call will come from someone claiming to be Revolut's fraud team, and they will know things about you that only your bank should know," said George Foley, cybersecurity specialist for ESET Ireland.

"That is how they get past your guard. Then comes the bit that costs you money. Your account has been compromised, they say, so move your balance to this safe account while we sort it out," he said.

But he warned that there is no safe account.

"Revolut will not ring you and ask you to move money, and neither will AIB, Bank of Ireland or the Gardaí. If you get that call, hang up, open the app and message them yourself," he advised.

ESET Ireland warned that the stolen documents could also be used to open accounts or apply for credit in other people's names, which may not surface for months.

"Anyone who received a notification from Revolut should check their credit record with the Central Credit Register, which is free, and consider replacing the affected document if Revolut confirms an ID copy was included," it added.