British fintech Revolut confirms sensitive customer data exposed in a scam; says only 'limited number' of users affected

British fintech firm Revolut on Saturday (local time) confirmed that sensitive customer data was exposed in a scam involving an unauthorised third party that used a legitimate government email domain.

According to a TechCrunch report, the disclosed information included customers' identity and contact details, including their dates of birth, postal and email addresses, phone numbers, and copies of their identity documents, such as passports and driver's licences.

Additionally, the exposed data may have also included verification selfies, account statements, and users' transaction histories.

Crypto security researcher ZachXBT shared information about Revolut's email to affected customers late on Friday. According to the researcher, the incident appeared to have targeted high-net-worth users.

What did Revolut say?

The company said it blocked the email address after discovering the scam and notified the relevant government agency, law enforcement authorities, and regulators. It added, “Revolut systems and customer funds are unaffected.”

A spokesperson for the British fintech said only a "limited number" of customers were impacted, adding that the company has already reached out to those customers directly. However, it has not disclosed the exact number of people affected by the data breach, whether the incident was limited to a particular market, or which government agency was involved.

The spokesperson, in a statement, said, "Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information."

The incident comes at a time when Revolut is rapidly expanding its global footprint and customer base, increasing the potential significance of any exposure involving sensitive customer information.

Revolut expands global footprint

London-based Revolut has over 80 million customers worldwide and operates as a bank in over 30 countries, according to its website. Founded in 2015, the fintech initially focused on smartphone-based currency exchange and money transfers.

The fintech has recently expanded its market presence in countries such as India, Mexico, France, and the United Arab Emirates (UAE).

Earlier this month, the British firm also received conditional approval from the US Office of the Comptroller of the Currency to establish a national bank in the country, which is expected to launch in the first half of 2027.

In a statement, Nik Storonsky, the firm's co-founder and CEO, said, "Conditional OCC approval is an important first step towards establishing the proposed Revolut Bank US," and added, "It gives us the foundation to build in the world's largest financial market and bring the full Revolut experience to millions of Americans."

According to AFP, Revolut has grown rapidly and was valued at $115 billion following a secondary share sale in July. The fintech is now reportedly weighing a potential public listing at a valuation of up to $200 billion. It has also been expanding its banking operations in Europe and other global markets, securing banking licences in France and the UK in recent months.