Revolut customers on alert for scam calls after sophisticated data leak

Revolut customers are urged to be alert for scam calls after a data leak exposed sensitive personal details, including ID documents.

Revolut did not say how many customers may have been affected by this breach.

Revolut customers are being advised to be on alert for any suspicious calls from people claiming to be from the digital bank following a leak of sensitive customer information over the weekend.

Over the weekend, Revolut confirmed that sensitive customer information was disclosed to an unauthorized third party after it received fraudulent requests from a legitimate government agency email domain.

A spokesperson for the company said that Revolut “identified a sophisticated external impersonation scam” where an unauthorised third party “utilised a legitimate government agency domain email to submit fraudulent requests for information”.

“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators. Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support."

Revolut did not say how many customers may have been affected by this breach.

According to reports, the compromised data includes customers' birth date, postal and email addresses, and phone numbers, as well as copies of their identity documents including passports and driver’s licenses.

Revolut is the most popular digital bank in Ireland with 3.4m customers.

Cybersecurity firm ESET Ireland said they have concerns over the leaked data because passwords can be reset or changed easily in response to an issue like this, a passport scan cannot.

“A scammer who holds someone’s date of birth, address, mobile number and photo ID can make a phone call that sounds completely legitimate, because every detail they quote is right,” the company said.

Cybersecurity specialist for ESET Ireland George Foley said the call will come from “someone claiming to be Revolut’s fraud team, and they will know things about you that only your bank should know”.

“That is how they get past your guard. Then comes the bit that costs you money. Your account has been compromised, they say, so move your balance to this safe account while we sort it out. There is no safe account.

“Revolut will not ring you and ask you to move money, and neither will AIB, Bank of Ireland or the Gardaí. If you get that call, hang up, open the app and message them yourself.” 

ESET Ireland is warning that the stolen documents could also be used to open accounts or apply for credit in other people’s names, which may not surface for months.

The company advised that anyone who received a notification from Revolut should check their credit record with the Central Credit Register, which is free, and consider replacing the affected document if Revolut confirms an ID copy was included.

• Additional reporting Reuters