Revolut\u2019s mistake is the news, but the bigger problem is the growing number of companies being encouraged or required to keep copies of our most sensitive identity documents.<\/h5>\n\n\n\n![\"\"](\"https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2026\/09\/image-15-1024x576.png\")
<\/figure>\n\n\n\nBy Ken Macon<\/p>\n\n\n\n
Online bank Revolut has revealed that it gave out sensitive personal and financial information of an undisclosed number of its customers in response to a fake government request.<\/p>\n\n\n\n
The information that was handed over to an \u201cunauthorized third party\u201d reportedly includes names, dates of birth, occupations, addresses, phone numbers, account numbers, transaction histories (including Bitcoin), and even copies of government-issued IDs and onboarding verification selfies.<\/p>\n\n\n\n
Revolut claims that derived biometric face data was not.<\/p>\n\n\n\n
The company said that the data was handed over in response to an email that came from a real government agency\u2019s domain, but was not actually sent or authorized by that agency.<\/p>\n\n\n\n
The email passed several authentication checks (SPF, DKIM, and DMARC) that are designed to establish the authenticity of a message\u2019s origin and integrity, but do not verify the legitimacy of the legal request itself.<\/p>\n\n\n\n
Revolut said that it complied with the request \u201cunder the reasonable belief that it was an authentic government agency request\u201d \u2013 and only later found out that it was not.<\/p>\n\n\n\n
Revolut said it later realized its mistake, blocked the email address, and reported the incident to the relevant authorities.<\/p>\n\n\n\n
Revolut said that only a \u201climited\u201d number of its customers were affected by the data leak, and that the company\u2019s systems were not hacked, nor was any money stolen.<\/p>\n\n\n\n
The story broke on September 11 when Revolut customers started receiving an email notice about a data leak, and the news was picked up by media outlets the following day.<\/p>\n\n\n\n![\"Revolut](\"https:\/\/media.reclaimthenet.org\/images\/2026\/09\/KUHJrRG0g2rC.jpg\")
<\/figure>\n\n\n\nThe reason this is a recurring problem is that companies are keeping highly sensitive information about their customers\u2019 identities, and sometimes even financial transactions, for a long time, and this data is then available to be disclosed to third parties \u2013 either in response to valid legal requests, or, as in the case of Revolut, fake ones.<\/p>\n\n\n\n
One reason for this is know your customer (KYC) and anti-money laundering (AML) rules. Revolut\u2019s current UK customer privacy notice spells it out: the company generally keeps personal data of UK customers for no more than seven years after the relationship ends, and sometimes longer \u2013 for legal reasons.<\/p>\n\n\n\n
This means that even if you close your account, your identity documents don\u2019t disappear.<\/p>\n\n\n\n
<\/figure>\n\n\n\nBy Ken Macon<\/p>\n\n\n\n
Online bank Revolut has revealed that it gave out sensitive personal and financial information of an undisclosed number of its customers in response to a fake government request.<\/p>\n\n\n\n
The information that was handed over to an \u201cunauthorized third party\u201d reportedly includes names, dates of birth, occupations, addresses, phone numbers, account numbers, transaction histories (including Bitcoin), and even copies of government-issued IDs and onboarding verification selfies.<\/p>\n\n\n\n
Revolut claims that derived biometric face data was not.<\/p>\n\n\n\n
The company said that the data was handed over in response to an email that came from a real government agency\u2019s domain, but was not actually sent or authorized by that agency.<\/p>\n\n\n\n
The email passed several authentication checks (SPF, DKIM, and DMARC) that are designed to establish the authenticity of a message\u2019s origin and integrity, but do not verify the legitimacy of the legal request itself.<\/p>\n\n\n\n
Revolut said that it complied with the request \u201cunder the reasonable belief that it was an authentic government agency request\u201d \u2013 and only later found out that it was not.<\/p>\n\n\n\n
Revolut said it later realized its mistake, blocked the email address, and reported the incident to the relevant authorities.<\/p>\n\n\n\n
Revolut said that only a \u201climited\u201d number of its customers were affected by the data leak, and that the company\u2019s systems were not hacked, nor was any money stolen.<\/p>\n\n\n\n
The story broke on September 11 when Revolut customers started receiving an email notice about a data leak, and the news was picked up by media outlets the following day.<\/p>\n\n\n\n The reason this is a recurring problem is that companies are keeping highly sensitive information about their customers\u2019 identities, and sometimes even financial transactions, for a long time, and this data is then available to be disclosed to third parties \u2013 either in response to valid legal requests, or, as in the case of Revolut, fake ones.<\/p>\n\n\n\n One reason for this is know your customer (KYC) and anti-money laundering (AML) rules. Revolut\u2019s current UK customer privacy notice spells it out: the company generally keeps personal data of UK customers for no more than seven years after the relationship ends, and sometimes longer \u2013 for legal reasons.<\/p>\n\n\n\n This means that even if you close your account, your identity documents don\u2019t disappear.<\/p>\n\n\n\n<\/figure>\n\n\n\n