LAST UPDATE | 22 hrs ago

BRITISH FINTECH FIRM Revolut is under fire for releasing a number of its customers’ sensitive information to an unauthorised third party after it was duped by requests originating from a legitimate government agency email domain.

The company has remained tight-lipped on the severity of the data breach, saying only that a “very limited” number of its customers are affected. All those affected have been informed, it said.

It is believed that compromised data included customers’ dates of birth, postal and email addresses, phone numbers, and copies of their identity documents, like passports and driving licences.

It was also reported that customers’ selfies taken as part of the verification process in setting up an account were compromised.

It’s understood that around 680 customers have been impacted, including 12 in Ireland.

Revolut is believed to have already contacted the affected customers directly and is understood to be providing ongoing support.

A Revolut spokesperson said: “Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.

“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators. Revolut systems and customer funds are unaffected.

“We have contacted the limited number of impacted individuals directly to inform them and provide support.”

Revolut, which was founded in London in 2015 as a neobank, received its first official banking licence in 2018. Alamy Stock Photo Alamy Stock Photo

Cybersecurity firm ESET Ireland said it is concerned by the potential future uses of this leaked information.

The level of personal information stored by Revolut means scammers with access to this can pretend to be a legitimate member of Revolut’s fraud team, or of another company or agency, and commit further fraud against victims.

It was also flagged that this personal data could be used to open accounts or to apply for credit under someone else’s name.

Advice for Revolut customers

Cybersecurity specialist George Foley said anyone who received a notification from Revolut informing them that their information was part of this data breach should check their credit record with the Central Credit Register, he advised.

Those affected should also consider replacing their identification documents.
Foley noted that the public should be aware of scam messages and that Revolut, or any other bank or state agency, will not ask customers to move money.

Even if you were not notified by Revolut of a breach of your data, you can access the ‘chat’ section within the app – which can be accessed by tapping the account icon in the top left-hand corner of the screen – and ask the chat if your data was compromised within the breach, as demonstrated by the Irish Independent’s tech editor Adrian Weckler.

Revolut, which was founded in London in 2015 as a neobank, received its first official banking licence in 2018 from the Bank of Lithuania and the European Central Bank (ECB).

In December 2021, this was upgraded to a full banking licence by the ECB. This allowed Revolut to operate as a fully-fledged bank across the European Economic Area. 

While it was popular in Ireland from its inception for people transferring money, it officially launched as a specialised bank in Ireland in March 2022. In June 2026, it reported it had 3.4 million customers in Ireland.

It launched its UK bank earlier this year and is set to continue its expansion globally, gaining a conditional US banking licence on 3 September. Revolut said it was working with US authorities to launch a US bank in 2027.