Fraudulent government requests expose Revolut customer information
British fintech company Revolut has confirmed that it disclosed sensitive customer information to an unauthorised third party after receiving fraudulent information requests sent from the genuine email domain of a government agency. According to the company, the requests appeared to originate from a legitimate official source but were not authentic. Revolut failed to identify their fraudulent nature before releasing the information.
Reportedly affected data included customers’ dates of birth, postal and email addresses, telephone numbers and copies of identity documents such as passports and driving licences. Revolut has not disclosed the number of people affected but said that its systems and customer funds were not compromised. After discovering the incident, Revolut blocked the relevant email address and notified the government agency concerned, law enforcement bodies and the appropriate data-protection and financial regulators.
The incident demonstrates a significant weakness in disclosure procedures that rely heavily on the apparent authenticity of an email address. A message sent from a genuine government domain may still result from a compromised account, misuse by an insider or manipulation of the agency’s systems.
Organisations that regularly receive requests for personal information from the police, regulators, government departments and other public authorities must establish not only that a request appears genuine, but also that the requester has the necessary authority and that the proposed disclosure is lawful, necessary and proportionate. Requests involving identity documents, financial information or other high risk data should be independently authenticated using contact details obtained from a trusted source, rather than those supplied in the request itself. Unusual requests, changes in established procedure and demands involving multiple individuals should trigger additional verification and escalation.
Disclosure logs should record the requester’s identity, legal basis, information supplied, verification undertaken and person authorising the release. Organisations should also test these procedures against scenarios in which an attacker has access to a legitimate external email account.
Readers interested in strengthening their organisation’s approach to preventing and responding to cyber incidents may wish to attend the Workshop ‘Cybersecurity & Data Breach Prevention, Detection and Notification in AI-Enabled Organisations’, available in person on 24th September and virtually on 25th September, at PDP’s 25th Annual Data Protection Compliance Conference.
