Revolut sends out passports and Bitcoin records to a fake email. What to do now

Revolut has confirmed it handed over customer files to an impostor who used a real government email domain. Notices went out on Friday warning customers and investigators and crypto researcher ZachXBT brought the case into public view on Saturday, September 12.

Customer emails describe a request that looked official because it arrived from an agency domain and passed standard mail checks. Staff treated it as genuine and sent the just files. Revolut later decided the mailbox was unauthorised and shut it down. Company systems were not broken into, they say, and no cash left accounts. Passcodes and login details were neither part of the bundle.

ZachXBT: Revolut Allegedly Leaks User Data, Likely Targeting High-Net-Worth Individuals

On-chain investigator ZachXBT issued an alert on his channel stating that fintech giant Revolut appears to have mistaken a fraudulent government information request for a legitimate one,… pic.twitter.com/NJ2tyw5ito

— Wu Blockchain (@WuBlockchain) September 12, 2026

What files went out

Passport or driving-licence copies and the selfie used for identity checks sat in the pack. So did full name, date of birth, occupation, home address, email and phone number. Account statements listed IBANs, opening dates, withdrawals and the full payment trail, Bitcoin included. Revolut says the biometric face template itself was not included, only the still photo original given by Revolut by customers. It has not said how many customers are affected yet. ZachXBT judges the group small and tilted toward high-net-worth users.

Officials at the firm say they told the agency, police and regulators, then blocked the address. That does not shrink the value of the files. A scan of a passport plus a matching face photo is enough for someone to open accounts, apply for credit or apply for a SIM swap. Transaction lists make later emails look personal.

This is not Revolut’s first brush with fraud worries. Euro Weekly News has previously covered how police fraud complaints stacked up against the app and what a French banking licence means for Spain-based customers. Passport scans have also been a running risk after the Eurail leak and hotel ID theft in Italy.

How to protect yourself

Treat every unexpected “Revolut”, tax office or police message as hostile until you prove otherwise inside the app. Do not use phone numbers or reply-to addresses in the inbound mail. Hang up on anyone who already “knows” your transactions and wants a code, a card PIN or a move to a “safe account”. That pattern matches smishing and vishing already circulating in Spain.

Lock down the phone number first. Ask your mobile firm for a port-out or SIM-swap PIN so nobody can steal the number and intercept one-time codes. Turn on app-based two-step checks on email, Revolut and any exchange.

Check whether a replacement passport or licence is worth doing if you received the notice. UK holders can follow ICO steps after a personal data breach and identity-theft advice, including a CIFAS Protective Registration. Britain’s National Cyber Security Centre explains how to spot official-looking scam mail. Residents in Spain can ring INCIBE’s free 017 line.

Readers who bank with Revolut from Spain or the UK should assume follow-up scams will name real payments. Verify every alert in-app. Report odd activity to Revolut chat, your bank and local police. Money in the account may still be there. Identity papers and a Bitcoin trail are already in someone else’s hands.