You know that tiny jolt you get when you see the words “security update” and “your account” in the same sentence? Yeah. Revolut says it accidentally shared customer info with a threat actor who pretended to be a government agency—using an email domain that passed authentication checks . The good news: Revolut says its systems and customer funds weren’t touched . The not-so-fun news: the shared info can include the kind of stuff that makes scammers drool (think ID docs, selfies, IBANs, and even full transaction history) . Let’s sort out what happened and what you can do right now—without panic-refreshing your app every 30 seconds.
What Happened (aka: How a “Real-Looking” Email Led to Real Data Being Shared)
Here’s the plain-English version of the Revolut data breach: someone pretended to be a government agency and emailed Revolut asking for customer information. And the message didn’t look like your typical “Nigerian prince” nonsense.
Revolut told affected customers that the request appeared legitimate because the communication “carried valid domain authentication credentials,” so it was handled “under the reasonable belief” it was a real government-agency request.
That detail matters because it explains the “how” without any movie-style hacking. This was a trust problem. The attacker didn’t need to break into Revolut’s app. They didn’t need your password. They just needed a request that looked official enough to pass the usual email checks and trigger a human process.
“So… was Revolut hacked?”
Based on what Revolut has said publicly, this wasn’t about Revolut’s systems being broken into. Revolut stated that “Revolut systems and customer funds are unaffected.”
That’s a big line to underline. It suggests the incident is about data being shared externally, not a criminal roaming around inside Revolut’s infrastructure moving money.
How many people were affected?
Revolut has said the breach impacts a limited number of customers, but it wouldn’t share an exact number when asked.
If you’re reading this and thinking, “Okay cool, but am I in that limited number?”—same. And that uncertainty is why it’s smart to treat this like a real risk until you’ve checked your own situation (and why the next part is all about what data could’ve been shared and what scammers can do with it).
The “What Exactly Could They Have” Checklist: Data Types That May Have Been Exposed
If you’re trying to figure out whether this Revolut data breach is a “meh” situation or a “change-everything-now” situation, it comes down to one thing: what data was actually shared.
Revolut said the information sent to the threat actor can include a mix of personal details, ID verification materials, and financial activity.
1) Identity details (the basics scammers love)
Revolut says the shared data may include:
- Full name
- Date of birth
- Occupation
What criminals can do with it: This is prime “confidence-building” material. If a caller already knows your birthday and job, you’re way more likely to believe the rest of their story.
2) Contact details (how they reach you on a bad day)
Revolut says contact details may include:
- Postal address
- Email address
- Telephone number
What criminals can do with it: It’s the fuel for phishing and social engineering—emails, texts, calls, even old-school mail. And once they’ve got multiple ways to reach you, blocking one channel doesn’t end the problem.
3) Document + verification data (the “KYC” stuff)
Revolut says the shared data may include:
- Copies of identity documents (passport and/or driver’s license)
- Facial verification images (selfies used for Know Your Client verification)
What criminals can do with it (realistically): This is where things can get personal. ID scans and selfies can be used to make scams more believable (“we’ve verified you before”), and they can also be abused in identity-related fraud attempts where a “proof of who you are” is needed.
4) Account statements + IBAN (banking details, minus the PIN)
Revolut says the shared data may include account statements, including IBAN numbers.
What criminals can do with it:
- Send you very convincing “payment issue” or “chargeback” messages
- Use your real banking identifiers in scams to look legit
- Attempt invoice/redirection tricks (“pay this updated IBAN instead”)
5) Withdrawal records (a neat little map of your habits)
Revolut says the shared data may include withdrawal records.
What criminals can do with it: Build a script that sounds like it came from support: “I can see you withdrew £X on Tuesday—was that you?” It’s creepy, and it works because it sounds specific.
6) Full transaction history (yes, including Bitcoin transactions)
Revolut says the shared data may include full transaction history, including Bitcoin transactions.
What criminals can do with it: Transaction history is basically your spending autobiography. It can reveal who you pay, where you shop, what subscriptions you forget you have, and whether you touch crypto—details that scammers can twist into fake “compliance,” “fraud review,” or “account verification” messages.
Why High-Net-Worth People Might Be the “Special Menu” (and Why That Still Matters to Everyone Else)
Once you’ve seen the type of data that may have been shared, the next question is: who would a scammer want most?
Crypto fraud investigator ZachXBT said the Revolut incident “seems to have been targeted at high net worth users.”
That tracks with how these things usually play out: if you’re a criminal, you don’t want “a lot of victims.” You want the right victims. People with bigger balances, bigger transfers, or crypto activity tend to be worth more per attempt.
Why “high net worth” is attractive to attackers
If someone looks wealthy (on paper), a scammer can:
- Go bigger with the ask (“move funds to a ‘safe account’ right now”)
- Spend more time grooming the victim (because the payout is higher)
- Use more convincing pretexts (compliance, enhanced verification, “source of funds” checks)
ZachXBT’s comment doesn’t mean everyone else gets a free pass. It just hints at the attacker’s shopping list.
Why it still matters if you’re not rich (or don’t think you are)
Even if you’re not “high net worth,” having your details in a breach can put a target on your inbox. The risk is less “they’ll drain your account in 30 seconds” and more “they’ll run a really believable con.”
Here are the everyday scams this kind of exposure can supercharge:
- Fake “compliance” checks
You get an email or call that sounds official: “We need to confirm details to keep your account active.”
They may push you to share a code, confirm a transfer, or upload documents again.
- “Your account is locked” texts
A short SMS with a link. You tap it because you’re busy, slightly stressed, and it looks urgent.
- “Verify your identity” emails
They’ll copy the vibe of fintech security emails and try to funnel you into a login page or a chat with “support.”
The ugly truth: you don’t need to be wealthy to be profitable. You just need to be reachable, believable, and catchable on a tired Tuesday.
What Revolut Says It Did Right Away (and What You Should Do Right Now)
If you’re thinking, “Okay… but what did Revolut actually do once it realized something was off?”—they’ve shared a few specific steps.
Revolut says that once the issue was detected, it blocked the address and alerted the relevant government agency, plus law enforcement, data protection regulators, and financial regulators.
That’s the company-side response. Now here’s the part you can control.
Do this today (30–60 minutes, tops)
Think of this as “make yourself annoying to scam.”
- Treat every message as suspicious until proven otherwise
- If you get an “account locked” text or “verify your identity” email, don’t click the link.
- Open the Revolut app the normal way (from your home screen), and check alerts there.
- If you need support, go through the in-app help, not a number/email from a message.
- Tighten login + access
- Change your Revolut password if you reuse it anywhere else (password reuse is how small problems become big ones).
- Turn on/confirm two-factor authentication where available.
- Check your device list/sessions (log out anything you don’t recognize).
- Set your own “tripwires”
- Turn on push notifications for card payments, transfers, and crypto activity (you want your phone to snitch instantly).
- Scan recent activity for anything you don’t remember: small “test” transactions can be a red flag.
Do this week (so future-you doesn’t hate present-you)
These steps are about phishing resistance + ID misuse risk.
- Watch for targeted, personal-sounding scams
If someone references real details (“we see your withdrawal on Tuesday…”), don’t take it as proof. Take it as a warning sign.
- Be extra picky with identity requests
If any service asks you to re-upload passport/driver’s license/selfie “because of a security update,” pause. Go to the official app/site by typing it yourself.
- Consider fraud protections where you live
Depending on your country, you may be able to set up a fraud alert or credit freeze with credit bureaus. It’s boring admin, but it can block certain types of identity-based openings before they start.
Quick “if this happens, do that” cheatsheet
- You clicked a link and entered details: change your Revolut password immediately and contact support in-app.
- You see a transaction you don’t recognize: report it right away inside Revolut and lock/freeze cards if needed.
- You’re getting a wave of calls/texts: assume your details are being worked through a script—stop engaging and document what you receive.
Revolut says it notified authorities and regulators. Your job is simpler: make it hard for anyone to talk you into doing something fast, emotional, and expensive.
