Revolut falls for fake government requests, hands over customer data

British bank Revolut exposed sensitive customer information after falling for fraudulent requests sent from a legitimate government agency's email domain. In a statement shared with The Register, Revolut confirmed the attack, but did not specify how many customers were affected. The company also did not provide a list of …

[fnusnu]

Why wasn't this encryoted before it was sent? Why didn't they send the de-cryption key via a secure (verified) second channel?

[Yet Another Anonymous coward]

Because encryption is evil and and only used by terrorists, child abusers and people campaigning against data centers.

What form of encryption does the law specify for supplying data demanded by a secret government demand for data? Does asking for details mean you are not cooperating and refusing to hand over the keys? Does that get the CIO 5years in jail?

Remember when the comments at some vulture based news organization said that secret government letters demanding data where it was illegal to say you had received one or even discus it with your lawyer would lead to hacks?

[herman]

encryoted - That doesn't seem to be ROT13 or AES1

[Anonymous Coward]

If you're sending data directly to an unauthorised 3rd party it barely matters whether you send it unencrypted or send it encrypted and give them the key separately.

The article doesn't mention how Revolut sent the data.

[Homo.Sapien.Floridanus]

time to eat your own cyber training dog food?

[MachDiamond]

"Why wasn't this encryoted before it was sent? Why didn't they send the de-cryption key via a secure (verified) second channel?"

Why was it sent at all sans a court order?

Even if a court decree wasn't going to be necessary, there's usually a horribly complicated process for anything the government does. If it's just an email asking for the company to send over a load of PII in any old format, that should be highly suspicious. A real government wants it in an obsolete file format that hasn't been used commercially for at least a decade and will also want the company to fill out a load of forms and attest the data meets some sort of accuracy standard and if it doesn't, there could be a giant fine. All of this even though it's the government wanting the information, not paying for it.

If it were my company, I'd charge money to prepare the data and insist on that payment clearing before it was delivered.

[Evil Auditor]

You'd be surprised how modernly easy it is to exchange data with the Financial Conduct Authority - mostly e-mail it is. Oh wait, maybe I wasn't communicating with them at all?!!!

[Anonymous Coward]

Recently passed legislation (in the UK) requires many financial organisations such as banks and pension companies to report to HMRC the state of your accounts, interest and other payments, and significant transactions. All without a warrant.

They are profiling you for evidence of fraud and/or tax evasion, or at least unpaid tax, and also for benefit fraud if you receive any benefits. And they are deploying AI to do the analysis! This is also why many banks are asking for additional proof of identity for accounts that you may have had for decades, so they can pass it on for HMRC to map your finances.

This information grab also extends to online market places like ebay and etsy. They also have to report on how much your transactions have earned you. So if you sell a lot of your own stuff on ebay, prepare to defend the amount of income, because the tax man will automatically make the assumption you are buying to sell, which would count as taxable income.

The gaps between systems are being closed to maximise the recognised income they can tax you on, and the first you will know about it is when an unexpected plain brown envelope drops onto the door mat!

I got my most recent tax code notification through which was reduced as a result of the small amount of interest which will possibly be earned by a savings account that was reported by my bank, that may need to be taxed at 40% (or the difference between 22 and 40%) because I'm still on the cusp of the higher tax rate. I probably won't cross the threshold, so I will probably have to claim the tax back next year! Never happened before, and the letter explained that this is what the reduction was for.

If you're no longer paying tax by PAYE, instead of a tax code notification, the letter will be a demand to pay they tax they've estimated, with a very short time to challenge or pay.

This may sound like a conspiracy theory. It's not.

[David Hicklin]

> Recently passed legislation (in the UK)

It is also part of the Fraud (as you mention) and Money Laundering checks, and if you are evading paying tax that you should be paying then I hope they throw the book at you (or whoever)

Also that sort of data mapping about you has existed for ages and not just with governments.

I do get what you mean about savings accounts interest, I am well below the threshold for that and it still appeared as a deduction, fortunately I am just below the (reduced) tax threshold this year so not paying any tax either!

[Anonymous Coward]

What the recent legislation (introduced a couple of years ago, coming into force January 2026 - can't remember the actual name) has done is remove the need for warrants. As I understand it, previously, HMRC, DWP et. al. within Government departments had a right to look, but still had to obtain a warrant on an individual basis (which was nearly always given). Now they don't need a warrant, and so now demand that the financial institutions provide returns for all of their UK customers every year, plus accurate identification information without even an explicit request. It's another level in surveillance.

What this enables is HMRC to programatically identify even small breeches of income declaration. Previously, many minor issues, often completely inadvertent, passed by undetected, with HMRC deciding that they were too small to even bother trying to identify. I'm sure that many people have done something without even knowing (interest on savings accounts when earning above the higher earnings limit is one such example, or the £1000 untaxed thresholds on hobby income that disappears if you're a higher rate tax payer). Now, nothing seems too small. And it would appear that they judge you effectively guilty of evasion (for instance when selling something quite large on ebay that you're entitled to sell without declaring, such as personal items you've owned for some time), requiring you to defend what you've recieved and not declared. You're guilty until you can prove yourself innocent. There's already documented instances of this, and they appear to automatically assume the most beneficial case for themselves.

[Efer Brick]

Also, warrant (or equivalent thing), no secure portal for uploads? Email FFS EMAIL!

[ScottK]

Why was it sent? Why are they responding to emailed information requests? Surely there should be a procedure for this that doesn't involve just sending an email asking for sensitive data?

[Anonymous Coward]

This is just poor. Very poor. What on earth did they think Government wanted that data for and why did they just hand it over via email? Are they that stupid? Clearly they are.

Your customers data should be the gold you lock in a vault with a ravenous bear guarding the door.

New bank, completely lacking in decades if not hundreds of years experience. I'm glad I don't use them.

[Yet Another Anonymous coward]

>What on earth did they think Government wanted that data for

You aren't allowed to ask.

Remember when the police raided the Guardian to destroy emails from Julian Assange and the Gruniad BOFH had to find some old hard drives for them to be photographed hitting with hammers?

That's the level you expect when dealing with govt demands. But remember they have hammers

[herman]

Exactly - the Revolut BOFH should have emailed them some old Goatse porn not real customer data.

[Goodwin Sands]

>You aren't allowed to ask.

Nope, there're quite a few routes and reasons why govt might ask a bank for cust info and I don't believe any of them disallow the bank challenging the request *if* the bank feels it needs to.

>Remember when

Nope, it wasn't the police, it was 2 bods from GCHQ.

Nope, it wasn't emails from Assange, it was The Guardian's own copy of the Snowden files.

Nope, it was the actual drives.

[Anonymous Coward]

Nope, it was the actual drives.

Correct, it was the actual drives containing a copy of the Snowden files. The destruction of those was symbolic however as there were other copies abroad and in the cloud. A former colleague (RIP) said they were amateurs using drills and angle grinders to do the job. He’d said if you want it done properly you use thermite, especially as the drive enclosure was probably aluminium. He said yes it was probably more satisfying to take a drill to things but getting it properly destroyed, quickly and easily beyond doubt just needed a hint of the thermite.

[Goodwin Sands]

>in the cloud

How sure are you that copies were "in the cloud" in July 2013? I'll be very very surprised if it were true.

But please share what you know. It's a fascinating bit of history.

[JimboSmith]

It was reported that Snowden had stored the stolen documents on the cloud by a few sources. Here is one

https://www.thefiscaltimes.com/Articles/2013/11/26/Snowden-May-Have-Stored-Doomsday-Info-Data-Cloud

[Goodwin Sands]

That was Snowden's health insurance. I'd forgotten about that. Material to be made available if the US harmed him. Not the full set of docs, or anything like it, but damaging enough if released to make the US think twice. Thanks for the link and perhaps that is what AC was thinking of.

[Charlie Clark]

Depends on the jurisdiction. While most countries require a court order for such requests, America infamously doesn't, and it wasn't that long ago that TLAs, or people purporting to be from the "government" sent faxes to various companies demanding they hand over documents.

Need to know more about how Revolut handled this but, a simple e-mail request should never suffice. But streamlined processes and minimal personnel are some of things that Revolut likes to tout. Wouldn't be surprised if other companies have reacted in similar ways to similar requests.

[Anonymous Coward]

‘People from the US Government’ …. Like Musk’s DOGE fuckers !!!

[Charlie Clark]

15 years ago it was literally anybody able to mockup a half-decent fax.

[Fruit and Nutcase]

New bank, completely lacking in decades if not hundreds of years experience.

Just remember, old banks are shredding experience, and going lean and outsourcing to cheap overseas body shoppers

[elsergiovolador]

What on earth did they think Government wanted that data for and why did they just hand it over via email?

Only explanation there is is perhaps because that was a routine thing do to and accepted practice? But what do I know.

[FIA]

New bank, completely lacking in decades if not hundreds of years experience. I'm glad I don't use them.

Erm... what do you mean by that?

[WSWS]

Yes, because established banks *totally* have centuries of experience with getting emails from the government demanding data.

[Anonymous Coward]

Possibly related to employing Lawyers as DPO's ? - DPO's need good IT and Security expertise to better understand risks associated with Data Protection. Not just the ability to read legalese.

[wolfetone]

"They say ongoing investigations and confidentiality obligations prevent Revolut from providing further details."

If only they had said this to the "Government" in the first place, would've saved them a whole load of hassle in the long run.

[werdsmith]

If I spoke to Revolut about my own account they would expect me to jump through several ID hoops first.

Nobody thought to go back to the requester and check the credentials. I deal with a government department with a contractor and I cannot send out anything at all apart from through the secure email service that the government run.

[Anonymous Coward]

""Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information," the spokesperson said."

they changed the FROM: address?

[TimMaher]

Re: FROM: address

If they right clicked on it they might have seen “[e-mail]”.

[Anonymous Coward]

Re: FROM: address

"If they right clicked on it they might have seen “[e-mail]”."

Ahh the government agency in question was HMRC then!

[Mishak]

You would have hoped...

That a government domain would do everything it can to prevent spoofing from going undetected by a mail scanner. However, this is a government agency we're talking about.

Why have digital signatures for email never caught on?

[oldandgrey]

A sophisticated external impersonation scam

"Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information,"

Are we to understand that the "unauthorised third party" had access to the DNS of the "legitimate government agency domain" to fiddle with its SPF and DKIM and DMARC records? This must be a joke!

[wolfetone]

Re: A sophisticated external impersonation scam

That is only if you think Revolut have that level of email security in place, where it would immediately block any email that doesn't have DKIM etc set up properly.

Where I work we have this in place, and every so often I will get some dickhead come to me going "sUmm1 cARnt emale uSs bcUz of DKIM", and I have to explain it's the sender's problem to solve not mine to add to a safe list. Eventually they relent, but so much of the time is spent reminding the sender's IT department that there is indeed a problem on their end and it's up to them to fix it, not for me to whitelist them.

And I would imagine Revolut's IT department don't have the ability to say "no", and that has put them in this position.

[RockBurner]

Quite glad now that I've been ignoring the recent "We need to double-check some of your personal details" emails that have been (purported to be) coming from Revolut.

Ah well, another shitty online fintec services account bites the dust... Good thing I only used it for holiday spendings (and it's nigh on empty iirc).

[Anonymous Coward]

Revolut used to be one of the scammer's favourite 'banks' according to the BBC's Scam Secrets podcast

They don't need to double-check details, they'll accept anything

[Woodnag]

To me, the elephant in the room is that this bank was quite happy to pass on complete confidential banking details ON REQUEST, not in response to a court order.

[Valeyard]

yeah it had to be primed i think. like it was farage and his backers so the bank was already half expecting to get this request

[Anonymous Coward]

Regulators like the FCA have sweeping powers … to regulate. They don’t need a (suspected criminal activity) court order.

[tiggity]

GDPR breach

"Whichever identity document customers submitted as part of the account registration process – passport or driver's license – was compromised"

Banks fall under money laundering regs, so unlike most organisations (which should delete proof of ID docs once ID was proven, else they face trouble* fine for unnecessary retention) they unfortunately have to retain** those docs under legislative requirements, even after account is closed.

However, the fact they must retain such sensitive PII really should mean they should be taking the utmost care in verifying data access requests are legitimate, as they have copies of high quality "gold standard" identity theft content that few other organisations are allowed to retain.

Unless there were particular legal requirements in a request, and (importantly) the request had been thoroughly verified, you would not expect ID docs to be provided as a "standard" dataset response as they are very security sensitive PII.

Fortunately my (not Revolut!) old bank account "proof of ID" is stored as photocopies in a filing system as it pre dated image data being stored electronically - and is a long expired passport and paper driving licence photocopy (for an outdated address as only utility bill needed for subsequent change of address proof). Although my PII can still be fraudulently obtained, with it not being possible just at the click of a button there is slightly more chance of someone engaging their brain before giving the data away as it's a PITA for staff to digitize the old photocopies (assuming they used archival quality paper & stored them well so the copies are still in good condition!)

* sadly only in theory usually as UK is typically crap on enforcing GDPR abuses.

** If you close your bank account & request a "right to forget" data cleanse then not much will happen immediately as e.g. ID docs cannot be removed for (IIRC) 5 years due to the money laundering regs. Bank account data is one of the few things with such a long immunity (or delayed response - whichever terminology you prefer) from right to forget requests. Note that 5 years money laundering regs limit is essentially the minimum, depending on the type of account / financial product all sorts of other regs exist with even longer data retention rules.

[Anonymous Coward]

Ah, "sophisticated"

because the truth of falling for the oldest trick in the book doesn't wash so well.

[Bartholomew]

Some lessons are hard to learn

The great news, or the bright side of this FUBAR, is that all other banks will learn from and never ever make the same or similar mistakes again.

/sarcasm off

[hri]

You would think such a transaction would require face-to-face verification. Your 1st-man chats with my 1st-woman over an American bourbon & "secrets" are exchanged. Then the extremely sensitive transaction goes thru. EXAMPLE: would a British firm sell-itself to an American firm without both top C-Suites meeting in-person to validate the exchange ? I really don't understand this blind tgrust in "digital exchange" when the record demonstrates so many flaws & failures? Epense of personal meeting ? Small beans compared to the worst-possible-outcome ... which a prudent person always assumes till proven otherwise.

[WSWS]

Do you really think that banks are able to demand a face to face meeting when government thugs demand their data?

[Gavsky]

"Erm, hello - I'm calling from Revolut. Just wondered if your department has requested a large amount of our customer data? It seemed really unusual so we thought we'd check"...

[WSWS]

The secret obviously being that it *isn't* extremely unusual, no?

[Colin Wilson 2]

"Sources close to the fintech say only a small proportion of its customers were impacted."

Yeah. Right.

[Tron]

This is why...

The government should need a court order for this sort of information, for each individual.

Digital national identity is a dumb idea.

Companies should collect the minimum amount of information on staff and customers and keep it offline/on paper.

Moving sign-ons to digital content heavy systems such as biometrics is a really bad idea.

State demands that everyone gather as much data as they can on all of their staff and customers and hand it over to the government when asked is a bad idea.

If they were able to use a govt. domain due to lax security, then the government are liable for the considerable amount of damage this will cause.

Paper is safer. Courtesy of AI-powered hacking, we may not even have online banking soon. It seems to be the only thing that AI can give you decent RoI on..

[Jason Hindle]

Government and regulatory bodies also at fault here

The process they impose on the banks clearly has flaws that can be fixed. Any requested information should either i) first be confirmed via a call or ii) sent back through a different known (and secure*) route. The article doesn't make it clear which of Revolut's jurisdictions the data heist took place in.

* Or, in the case of Germany, impose security standards almost incompatible with running a business, but insist that requested information be sent via FTP (sans S).

[Anonymous Coward]

This is the "bank" which claimed that they had transferred £100 to my real bank account, but when it didn't arrive said they had no record of where they had sent it and that

the information was only in an email which I didn't receive.

They are either crooked or utterly incompetent. Either way it's no surprise that they are balls-deep in crypto.

I haven't used my account with them since the transfer debacle. They still keep asking me to prove my identity under threat of losing my account if I don't comply at once, and have been doing so weekly for over five years.

[Valeyard]

The company balls deep in a currency designed for money laundering may be dodgy

Fuck me I'm learning things (honestly I didn't actually know revolut had a crypto connection til this article so fuck them right off)

[Evil Auditor]

...only a small proportion of its customers were impacted...

Let's assume a small proportion is 1 percent? That's only about 700'000 people having to find new unique identities. Or how does that work again when yours is stolen?

[Aging Hippy]

Government email address?

hackergov.uk

[DancesWithPoultry]

> driver's license

*Driving licence

Oh El Reg, must you insist on merkin grammar when talking about Blighty?

[MrGreen]

More Holes Than a Colander

HMRC, DWP, The Home Office, NCA etc. ?

Take your pick.

They can all ask banks for your data.

However, my money is on them claiming they were from HMRC:

Under standard domestic laws and international treaties like the Common Reporting Standard (CRS), UK banks and building societies extract key pieces of your KYC file and send them to HMRC automatically. A broader data set wouldn’t therefore appear unusual.

[orwellian doublespeak]

License to spill

Didn't they only just get their UK banking license?

[Anonymous Coward]

Amateurs.

"a sophisticated external impersonation scam"

An unexpected email from a forged government looking email address so they send back highly sensitive customer data, unencrypted. Pfft - amateurs!

Perhaps they shouldn't have a banking license.

[Alistair Dabbs]

Tempted to blame Revolut's lack of human staff

If you've ever held a Revolut account, you will know that no real people are available to deal with queries. Instead you have to chat with an AI bot which keeps getting things wrong. You then have to tell it not to talk bollocks, whereupon it apologises and gives you a completely different answer.

I can imagine how a determined hacker could gaslight one of these error-prone AI chatbots into apologising itself into compliance.