Revolut handed customer data to fraudsters using government email account

September 14, 2026 · The Record · Severity: MEDIUM

Revolut inadvertently provided customer data to fraudsters who impersonated government officials and exploited the company's internal data request procedures. The social engineering attack bypassed technical security controls by targeting human-operated support workflows. 📌 **Analyst Note:** This incident demonstrates that even sophisticated technical security can be undermined by weak human-process security. Fintech companies must treat support-accessible customer data as high-risk.

Key Takeaways

The Record reports that Revolut inadvertently handed customer data to fraudsters using a government impersonation scheme, exploiting the company's data request procedures to obtain financial information without technical intrusion.
The incident reveals a critical gap in data verification processes at fintech companies, where social engineering of human-operated support workflows can bypass sophisticated technical security controls entirely.
Fintech companies must implement strict multi-factor verification protocols for customer data access requests and train support staff to recognize government impersonation social engineering tactics.