Revolut Says Fake Government Requests Exposed Customer Data
Revolut has confirmed a customer data breach carried out through fraudulent government requests, a technique that turns a bank's own legal compliance channel into the attack surface.
Revolut confirmed that customer data was exposed after attackers submitted fraudulent government requests, and said it has notified affected customers and alerted the relevant government agency, law enforcement and financial regulators.
Revolut has confirmed that customer data was exposed after attackers submitted fake government requests to the company, a method that targets not a bank's firewalls but its lawyers. The fintech said it has notified the customers affected and reported the incident to the relevant government agency, to law enforcement and to financial regulators, according to TechCrunch.
The company has not publicly quantified how many customers were caught up in the incident, and the fraudulent requests have not been publicly attributed. What is confirmed is the shape of the attack: someone impersonated an official authority convincingly enough that a regulated financial institution handed over customer information.
How a fake legal request becomes a data breach
Every bank, payments company and large online platform maintains a channel for law enforcement and government agencies to ask for customer records. In a genuine case, a police force or regulator sends a formal demand — often accompanied by a court order or statutory authority — and the company's legal or compliance team verifies it and responds within a set window.
There is a faster lane inside that system. Emergency requests, sometimes called emergency data requests, exist so that an agency chasing an imminent threat to life does not have to wait days for paperwork to clear. They typically skip the judicial sign-off that a subpoena or warrant requires, because the premise is that a delay could be fatal. The trade-off is that verification rests almost entirely on whether the request looks and sounds authentic.
That is the gap attackers exploit. The materials needed are mundane: an email address on a government-looking domain, letterhead, the formal register of an official demand, and urgency. The payload is not malware. It is a request that a compliance officer, acting in good faith and under time pressure, feels obliged to honor.
Crucially, none of a company's expensive defensive technology is engaged. There is no intrusion to detect, no unusual login, no exfiltration of data through an anomalous channel. The data leaves through the front door, logged and documented, because an employee authorized it. Detection usually comes later — when the supposedly requesting agency is contacted and says it never sent anything.
Why fintechs sit in the blast radius
Digital-first financial companies are an attractive target for this technique for reasons that follow directly from how they are built. They operate across many jurisdictions, which means their compliance teams routinely field requests from agencies whose formats, seals and email conventions they cannot be expected to know cold. A demand purporting to come from an unfamiliar foreign authority is harder to sanity-check than one from the local police force a bank has dealt with for decades.
They also hold exactly the information an attacker wants. A neobank account application aggregates identity documents, addresses, dates of birth, phone numbers and transaction history in one place. That combination is the raw material for account takeover, SIM-swap fraud and social engineering against the customer's other providers — and it is far more durable than a stolen card number, which can be reissued in days. A date of birth cannot be reissued.
And the volume is unforgiving. A platform serving tens of millions of customers across dozens of markets receives a steady stream of legitimate official requests. Scale forces process, process forces speed, and speed is where a well-crafted forgery survives review.
What Revolut's disclosure does and does not settle
Three things in the company's response are worth separating. First, individual notification: telling affected customers directly is the step that lets them act — tightening authentication, treating unexpected calls purporting to come from the bank as hostile, and watching for attempts to reset credentials elsewhere. Second, the report to the relevant government agency, which matters because the impersonation of an official body is itself a matter for that body to investigate. Third, the notification to law enforcement and to financial regulators, which puts the incident into supervisory records and starts the clock on any regulatory review.
Second, the report to the relevant government agency, which matters because the impersonation of an official body is itself a matter for that body to investigate.
What remains open is scope. Without a stated number of affected customers, outsiders cannot judge whether this was a handful of targeted individuals — the usual pattern when a forged emergency request is aimed at a specific person, such as someone the attacker intends to stalk or extort — or a broader harvest. The two scenarios carry very different implications for remediation and for any penalty that follows.
Also unresolved: whether the requests exploited a weakness specific to Revolut's verification workflow or simply the structural weakness that the emergency-request system shares industry-wide. The answer determines whether the fix is internal or sector-level.
Customers can take steps that do not depend on the bank
Anyone notified should assume the exposed information will be reused in social engineering rather than in a direct raid on the account. The practical defenses are unglamorous. Treat inbound calls and messages claiming to be from the bank as unverified, and call back through the app rather than the number provided. Prefer app-based or hardware authentication over SMS codes, since a phone number in an attacker's hands is the first step in a SIM swap. Reuse nothing — an address and date of birth are the standard knowledge-based answers at other institutions.
The broader lesson for the industry is that identity verification runs in both directions. Banks spend enormously proving that customers are who they claim to be. This incident is about the reverse problem: proving that the authority on the other end of a legal demand is real. Cryptographic signing of official requests, out-of-band callbacks to published agency numbers, and centralized registries of authorized requesters have all been proposed as fixes. None is universally deployed.
Set against a calm market backdrop
Revolut is privately held, so there is no listed security through which investors can register a view on the incident. The read-across is to the listed banks, payment networks and identity-verification vendors whose compliance functions face the same exposure.
The wider market was untroubled at the last close before the disclosure. The S&P 500 tracker (NYSEARCA: SPY) finished at $764.29, up 0.85% on the day from a previous close of $757.83. The Nasdaq 100 fund (NASDAQ: QQQ) closed at $714.88, up 0.87%, and the Dow tracker (NYSEARCA: DIA) at $525.79, up 0.97% — all figures as of the last trade at 20:00 GMT on Sept. 11, 2026.
What to watch next: whether Revolut or a regulator discloses the number of affected customers; whether the agency whose identity was impersonated confirms an investigation; and whether supervisors in any of Revolut's markets open a formal review of how the requests were authenticated. If forged official demands are found to have worked at more than one institution, the response is likely to move from a single company's controls to the design of the emergency-request system itself.
Key facts
- Company: Revolut — privately held, no listed ticker
- Incident: Customer data breach via fake government requests
- Notified: Affected customers, relevant government agency, law enforcement, financial regulators
- Market backdrop: SPY closed at $764.29, +0.85%, as of 20:00 GMT Sept. 11, 2026
Frequently asked questions
What exactly happened at Revolut?
Revolut confirmed that customer data was exposed after attackers submitted fraudulent government requests to the company. Rather than hacking systems, the attackers impersonated an official authority convincingly enough that customer information was released. Revolut said it notified the affected customers and reported the matter to the relevant government agency, to law enforcement and to financial regulators.
How many customers were affected?
Revolut has not publicly stated a number. The company confirmed that it notified affected customers, but the scope of the breach has not been disclosed. Without a figure, it is not possible to tell whether the fraudulent requests targeted a small number of specific individuals — the common pattern in such attacks — or produced a broader data harvest.
What is a fake emergency data request?
Emergency data requests let law enforcement obtain customer records quickly when there is an imminent threat to life, skipping the court approval a normal subpoena needs. Attackers forge these requests using spoofed official email domains and letterhead. Because verification relies largely on the request looking authentic and arriving under urgency, a well-crafted forgery can be honored by a compliance team acting in good faith.
Why are fintech companies particularly vulnerable?
Digital banks operate across many jurisdictions, so compliance teams routinely handle requests from agencies whose formats and email conventions they cannot verify from familiarity. They also hold dense identity data — documents, addresses, dates of birth, phone numbers and transaction history — in one place. High request volume forces speed, and speed is where forged demands tend to slip through review.
What should affected Revolut customers do?
Assume the exposed data will be used in social engineering rather than a direct account raid. Treat unsolicited calls or messages claiming to come from the bank as unverified and call back through the app. Use app-based or hardware authentication instead of SMS codes to reduce SIM-swap risk, and avoid reusing personal details as security answers at other institutions.
Can investors trade on this news?
Not directly. Revolut is privately held and has no listed shares, so there is no security through which to express a view. The relevant read-across is to listed banks, payment networks and identity-verification providers whose compliance channels face the same structural weakness. Broad market trackers were higher at the last close before the disclosure.
Sources
Photo: Darlene Alderson · Pexels Licence — source
