Revolut warns customers after fraudsters obtain personal ID details using bogus official requests

A call from someone claiming to be on a bank’s fraud team can be convincing, particularly if they already know your name, address or date of birth. Those details may make an impersonation attempt feel genuine, but they are never proof that the caller is legitimate.

Revolut says that some customers’ personal information was disclosed after criminals used bogus official information requests. The practical rule is simple: do not verify an unexpected call, text or email through the route it gives you. Open the Revolut app yourself, or use an official web address you have found independently.

What Revolut says happened

Revolut says that an unauthorised third party used fraudulent requests that appeared to come from an official email domain. The company says the request was initially treated as legitimate because of that apparent source.

According to Revolut, it identified the issue, blocked the relevant address and notified appropriate authorities. It has said that affected customers are being contacted directly.

Revolut has also said that customers’ funds and its core systems were not affected. However, the risk in an incident involving identity details is not limited to someone accessing a Revolut account. Criminals may use the information to make later scams more convincing or to try to impersonate someone with other organisations.

A convincing-looking email address is not proof that a request is genuine. If a message involves money, passwords or identity documents, verify it through a route you choose yourself.

Which details may be at risk

Revolut has indicated that affected information may include identity and contact details. Depending on the customer and the documents held, this could include:

• full name;
• date of birth;
• home address;
• email address;
• telephone number;
• copies of a passport or driving licence.

The exact information involved matters. An email address alone creates a different level of risk from a copy of photo identification combined with an address and date of birth.

A password can be changed. A date of birth, address and image of an identity document are less easy to replace, which is why a criminal may try to reuse them over time. That does not mean fraud will definitely follow, but it is a reason to be more careful with unexpected contacts.

Why follow-up scams can seem so believable

Fraudsters often create pressure before they ask for anything. They may say your account has been compromised, that a payment is under review, or that you must move money before it is stolen.

Knowing personal facts can make the story more persuasive. A caller who quotes your address or date of birth may sound informed, but those details can be gathered through data breaches, phishing, public social-media posts, stolen post or other criminal activity.

Be especially wary if somebody:

• says you must act immediately to stop money being lost;
• asks you to transfer money to a so-called safe account;
• asks for a card PIN, password or one-time verification code;
• tells you to approve a notification in your banking app;
• asks you to download screen-sharing or remote-access software;
• tells you to remain on the call while you log in;
• says you must not discuss the matter with anyone.

No genuine bank should ask you to move money to another account in order to keep it safe. If a transfer is made under pressure, recovering it may be difficult.

If Revolut contacts you, verify it safely

A genuine notification may arrive by email or in the app. The safest approach is to treat the message as a prompt to check independently, rather than using it as evidence that the contact is real.

1. Open the app yourself

Use the Revolut app already installed on your device. Do not follow a link in a text, email or social-media message.

Check for in-app messages and contact support through the app to ask whether your account or documents were involved. If using a browser, type the address yourself or use a trusted saved bookmark.

2. Ask what information was affected

Find out which categories of information may have been disclosed. Ask whether copies of your passport, driving licence or other photo identification were involved.

Keep a note of the date you were contacted, the information you were given and any reference number. Save genuine correspondence, but do not forward it widely or post screenshots online, as it may contain personal information.

3. Protect the accounts linked to your identity

Review the security of your Revolut account and the email address associated with it. Use a unique, strong password for each account, especially for email, which can be used to reset passwords elsewhere.

Enable the security controls offered by the service, such as biometric app access, an app lock and two-step verification where available. Never share a verification code with another person, even if they claim to be from a bank, the police or Revolut support.

4. Check account activity

Review recent card payments, transfers, new payees, personal-detail changes and login alerts. Report anything you do not recognise through the app promptly.

Do not use a telephone number included in an unexpected message. If you need to speak to an organisation, use a number from its official website, the back of your card or its app.

Check for identity fraud in the UK

If identity documents or substantial personal details may have been exposed, checking your credit files can be sensible. In the UK, the main credit reference agencies are Experian, Equifax and TransUnion. You can obtain access to your statutory credit report without charge.

Look for unfamiliar credit applications, accounts, searches, financial associations or address links. Not every lender reports to every agency, so checking more than one report can provide a broader view.

If you find something you do not recognise:

• contact the lender using contact details found independently;
• ask the relevant credit reference agency how to dispute the entry;
• keep records of dates, names and reference numbers;
• consider Cifas Protective Registration if you believe you face a heightened risk of identity fraud.

Cifas Protective Registration can lead to extra checks when credit is applied for in your name. It is not a guarantee against fraud, and it can make legitimate applications take longer, so read the current terms before applying.

In England, Wales and Northern Ireland, suspected fraud can be reported through Report Fraud, the national reporting service. In Scotland, contact Police Scotland or seek guidance through the appropriate Scottish reporting channels.

Should you replace a passport or driving licence?

Do not automatically replace an identity document simply because a copy may have been exposed. First confirm whether that particular document was involved, then follow advice from the issuing authority.

For a UK passport, use GOV.UK and HM Passport Office guidance. For a driving licence, use the DVLA’s official website. If the physical document itself has been lost or stolen, report it promptly through the relevant official route.

Replacing a document does not remove copies already held by criminals. Be cautious of third-party websites offering to “secure” your identity or arrange fast replacements for a fee. Start with GOV.UK or the issuing organisation’s own website.

Common mistakes that make targeted scams work

Targeted fraud usually relies on understandable human reactions: worry, urgency and trust in familiar-looking details.

• Trusting caller ID. Telephone numbers and names can be spoofed.
• Calling back on the number provided. End the call and find an official route independently.
• Reading out a code. Verification codes are for you to enter into a genuine service, not to share.
• Moving money temporarily. A request to transfer money to a safe account is a major warning sign.
• Approving an unexpected app notification. Read it carefully and reject it if you did not initiate the action.
• Reusing passwords. One compromised password should not unlock your email, banking and shopping accounts.

Urgency is a fraudster’s tool. Pause, end the contact and start again through an official channel.

A practical checklist for the weeks ahead

If Revolut has notified you about this issue, take calm, proportionate steps:

1. Verify the notification through the Revolut app.
2. Confirm exactly which categories of data may have been affected.
3. Secure your Revolut account and linked email account with separate, strong passwords.
4. Turn on the security features available to you.
5. Review payments, transfers and account changes regularly.
6. Check your credit reports for unfamiliar activity.
7. Treat every unexpected contact about your money or identity as unverified until you have checked it independently.

The aim is not to memorise every possible scam. It is to make one habit automatic: if someone asks for money, a code, a password or identity information, stop the conversation and use an official route you found yourself.