Revolut handed customers' ID files to impostors posing as a government agency

Revolut has confirmed that it sent customers' identity documents and account records to people who were only pretending to be a government agency. Nobody broke into the bank. The requests came from a genuine government e-mail domain, and Revolut answered them the way it answers real ones.

What Revolut has said

The company's statement, first reported on 12 September 2026, describes "a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information". It says it blocked the address and alerted the agency concerned, law enforcement, and data-protection and financial regulators.

Revolut has not named the agency. It puts the number of affected customers at "limited" and gives no figure.

What went out

According to TechCrunch and The Register: dates of birth, home and e-mail addresses, phone numbers, copies of passports and driving licences, verification selfies, IBANs, account statements and full transaction histories, Bitcoin transactions included.

What the attackers say

The rest comes from the people who did it, so read it with that in mind. A group calling itself "iamnotavillain" told the Financial Times, as relayed by other outlets, that it obtained files on about 680 people in 31 countries and wants 6,000 XMR, roughly $3 million. Revolut says it has received no ransom demand.

According to the same reports, the group picked its targets from public blockchain data: it looked for Revolut customers with large crypto activity, then requested their files by name. The investigator ZachXBT, who made the incident public, said it appeared aimed at high-net-worth users. Italian media have tied the e-mail channel to Italy's certified-mail system; Revolut says only that it reported the matter to the Italian authorities.

Why this one is different

Most leaks of identity files begin with a break-in. This one went through the front desk. Every company that holds KYC records also runs a process for handing them to authorities on request, and that process depends on a person deciding whether a request is real.

Two public things were enough to aim it: a blockchain that shows who moves large sums, and a regulated company that knows those people's names and addresses.

What you can do

A file that has been handed over cannot be recalled. If you are a Revolut customer in the EU or the UK, you can ask the company in writing whether your data was disclosed in this incident; data-protection law gives you that right. Beyond that, the useful habit is an old one. The fewer companies hold your passport next to your wallet addresses, the fewer desks there are to fool.

The more usual way such files get out is covered in an earlier note on August's KYC breaches. How this catalogue grades services by what they collect is on the methodology page.

Sources: TechCrunch, 12 Sept 2026, The Register, 14 Sept 2026, Malwarebytes, 14 Sept 2026, Bitcoin.com News, 16 Sept 2026 — the attackers' claims