Banks keep copies of your passport, your driving licence and your face. This week, one of the world’s biggest banking apps handed copies like that to criminals. Nobody broke into its computers. Someone at the company believed a fake email.
What actually happened
Revolut is a banking app used by more than 80 million people, mostly on their phones, and it works in more than 30 countries. This week it confirmed that it had sent customer records to people who should never have seen them.
The criminals did not break in. They sent an email that looked like it came from a real government agency and asked for information about customers. The Financial Times reports that they had got into an email account belonging to an Italian state body . Staff treated the request as official and sent the files.
What went out: names, dates of birth, home and email addresses, and phone numbers. Copies of identity documents, including passports and driving licences. Facial verification selfies — the picture you take when an app asks you to prove you are real. Some customers also lost bank statements, transaction histories and crypto trading details, according to the researcher who published the notice.
Revolut has written to the customers affected; reports put the number at about 680. The company says customer money was not touched and nobody got into its systems. It blocked the email address and told the government agency, the police and the regulators.
Why this matters even if you do not use Revolut
A copy of your passport is worth more to a criminal than your card number. With a document scan and a photo of your face, someone can try to open accounts in your name, take out a loan or a phone contract, or pass a check at a company that has never met you. That is identity theft: a stranger pretending to be you, using your own documents.
The stolen details also make the next scam sound real. A fraudster who already knows your date of birth, your address and part of your account number does not have to guess. A call that opens with “we can see unusual activity on your account” lands better when the caller quotes facts that only your bank should know.
The people who took the data are not staying quiet. A group calling itself “Revolut Smilik” has told reporters it wants payment, and that it will publish more data every day until it gets some.
Revolut is not alone. Days earlier, IDScan, which checks identity documents for car rental firms and shops in the United States, confirmed that scans of more than 153 million driver’s licences from the US and Canada had been taken from its cloud platform. The FBI has opened an investigation. In both cases the prize was the same: copies of documents companies were trusted to keep.
What you can actually do
- If you use Revolut, open the app and look for a message about the incident. Check your recent transactions, saved payees and signed-in devices.
- Never use a link or a phone number that arrives in a message about a breach. Open the app yourself, or call the number printed on your card.
- Never send a photo of your ID or a selfie to someone who contacted you first. Verify yourself by logging in to the official app or website.
- Before sending a document copy to any company, ask what it is for, how long it is kept and who can see it.
- Turn on the screen lock and payment notifications for your banking apps, so an unexpected transfer shows up straight away.
- Check what is on file about you: in Germany you can order a free copy of your SCHUFA record once a year, and in the EU and the UK you can ask any company for a copy of your personal data.
- If your data was in a breach, complain to your national data protection authority: in the UK the Information Commissioner’s Office, in Germany the commissioner for your state.
Common misunderstandings
Myth: “This was a hack”
No software was broken. Someone at the company believed a lie. That is what makes this fraud hard to stop: a request can come from a real address, be handled by a real employee, and still be a crime.
Myth: “I have nothing worth stealing”
A passport scan and a selfie are exactly what someone needs to borrow your identity. That is why thieves pay money for them.
Myth: “They knew my date of birth, so they must be genuine”
After a leak, your details are in other people’s hands. A stranger quoting your personal information is a warning sign, not proof of who they are.
Myth: “Nothing has happened to me, so I am fine”
Identity fraud often shows up months later, when an account you never opened appears on your record.
What to watch for next
Expect more fake official requests. Security companies have warned for years that criminals imitate government offices, tax offices and the police; this case shows what happens when the imitation works.
Expect follow-up scams aimed at the people in the leak. Messages about “your documents found on the dark web” will reach many people, whether or not their details were involved.
Watch the regulators: the UK’s Financial Conduct Authority and the Information Commissioner’s Office both say they are looking into what happened. In Europe, the GDPR lets them fine companies for mishandled personal data.
The one thing to remember
A copy of your passport is as sensitive as the passport itself, and it ends up in far more places. Keep the copies to a minimum, and never send a document photo to someone who contacted you first.
When a message knows too much about you, that is the reason to slow down, not the reason to trust it.
Image credits: “Revolut card.jpg” by JFD~nlwiki, via Wikimedia Commons, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/).