Revolut leaks customer data to fraudulent entity posing as official agency

Revolut falls for fake request and leaks customer passports

What happens when a bank that boasts cutting-edge technology hands over your passport to a scammer? As of today, that is what has allegedly peine to Revolut. The leak did not come from a sophisticated hack, but rather from a fraudulent request that appeared to originate from a government agency. The company reportedly provided copies of passports, verification selfies, and complete transaction histories. The group targeting the firm is already circulating customer records —some high-profile— and demanding payment in exchange for not publishing more internal data.

A human error, not a system failure

The first trap in the narrative is calling it a hack. There would have been no technical breach here: someone with access validated a request that appeared official. And this is where the disagreement begins. The most lenient version points to an employee who failed to verify the requester's identity. The uncomfortable version suggests that no one with that level of permissions acts alone; moving that volume of documents would require several approvers. A third, cheaper, and more cynical hypothesis suggests the validation was done by an algorithm—and that saving on human review has these kinds of bills.

Biometrics under scrutiny

The collateral damage that nobody signed off on: the verification selfies. A photo of a face alongside an ID document is not the same as a password. With a face, ID, and an AI model, you can attempt to open accounts in someone else's name across dozens of sites, turning digital inconvenience into debt that is not yours. Against this backdrop, the solution most often cited is physical verification on a personal device—a certificate, token, or authenticator—and not massive biometric scanning. The problem is that the digital bank's business model thrives precisely on eliminating those steps.

While awaiting official confirmation, the sequence invites both calm and distrust in equal measure: reports are circulating on social media, and the true scope remains unverified.

The customer who hands over their face to open an account in three minutes discovers that the shortcut comes with a toll. Revolut sold immediacy. They are charging for it in passport copies.