# A lawful-looking request. A disclosure to the wrong party.

ID: SA-007
Type: Documented incident
Audience / at-risk group: Banks, fintechs, legal and compliance teams; affected customers as data subjects
Subject: Revolut customer-data disclosure after fraudulent government-domain requests
Sources checked: 2026-09-15

## Lesson
For regulated firms, a trusted domain is not enough. Sensitive data requests need independent requester verification, authority checks and escalation paths before records leave the institution.

## Source findings
TechCrunch reported on 12 September 2026 that Revolut confirmed a limited number of customers were impacted after fraudulent information requests were sent from a legitimate government-agency email domain. The Block separately reported that the incident involved KYC and account data, with possible Bitcoin transaction history exposure. The Financial Times later reported that nearly 700 customers were affected and that the UK Information Commissioner's Office had opened an investigation.

## Limits
This case is based on public reporting and Revolut statements quoted by those outlets. The government agency, exact request documents, affected markets and final regulator findings were not publicly established in these sources. The incident should not be described as customer funds being stolen or Revolut's core systems being compromised unless later evidence supports that.

## Sources
- [TechCrunch](https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/) — Initial report with Revolut confirmation · 12 September 2026
- [The Block](https://www.theblock.co/news/business/2026-09-12-revolut-says-customer-kyc-bitcoin-transaction-data-exposed-after-fake-request-from-govt-domain-414516) — Follow-up report on KYC and transaction data exposure · 12 September 2026
- [Financial Times](https://www.ft.com/content/e0fe28a8-bc8c-460d-a7f2-972f725c0d46) — Follow-up reporting on affected-customer count and ICO investigation · 15 September 2026

Original editorial text: CC BY 4.0. Third-party captures, source texts, names and logos retain their own rights.