Revolut Breach Shows How KYC Data Became a Honeypot for Scammers

The useful part

Financial institutions ask customers for passports, facial images, addresses and information about their money to meet regulatory requirements. Stored together, however, the same records can become a ready-made targeting file for criminals, and obtaining it may not require breaking into a bank's systems. The incident was first circulated by on-chain investigator ZachXBT, who published screenshots of customer notices sent by Revolut.

How it works

• "Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators," a Revolut spokesperson said.
• We have contacted the limited number of impacted individuals directly to inform them and provide support." The statement did not identify the government agency, affected markets or number of customers.
• It also did not explain what verification was conducted before the requests were fulfilled or what changes had subsequently been made to the approval process.
• Banks, brokers, and crypto platforms don't accumulate customer records at wi...

Details worth keeping

Revolut told Finance Magnates that it had identified "a sophisticated external impersonation scam" in which an unauthorised third party used an email address within a legitimate government agency domain to submit fraudulent information requests. "Revolut systems and customer funds are unaffected.