Revolut data breach 2026: ID documents leaked after fake government emails

On 11 September 2026, warning emails from Revolut to some of its customers began circulating. The next day, Revolut confirmed to TechCrunch and Reuters what those emails said: the company had sent personal records to an outsider who emailed from a real government-agency address. Revolut had treated the messages as genuine official requests.

It says only a limited number of customers were involved and that it contacted them directly. It has not published how many people that is, which country they were in, or which agency was impersonated. After spotting the scam, Revolut blocked the address and told the real agency, the police, and financial and data-protection regulators. It says its own systems were not broken into and that customer money was not taken.

Your money was not taken. Your identity file was handed over.

Most write-ups of this story lead with the same two points Revolut wants you to hear: this was a fake government request, and no one stole money from Revolut accounts. Both of those are true. They are also not the part that changes your week.

The outsider did not need to crack Revolut’s computers. Revolut sent the files, believing it was complying with an official demand. What left the company, according to the emails TechCrunch reviewed, was the packet other institutions use to accept you as you: date of birth, home address, email, phone number, and copies of passports and driving licences. Those emails also warned that verification selfies, account statements and transaction histories may have been included.

That is not a password leak. You cannot issue yourself a new date of birth, and a copy of a passport does not become harmless because the bank app still shows the right balance. Someone now has, for at least some customers, the same documents you would present to open an account, rent a flat, or prove your name — sitting next to the address where you live.

How those customers were chosen is not confirmed, and neither is the size of the group. What is confirmed is what kind of file moved: identity paperwork, not a drained wallet.

What to actually expect

• Revolut says it has already emailed the people in this incident. There is no public list, and nothing on the internet can look up whether you were one of them. If a message about this did arrive, treat it as a warning — not as a reason to send more documents.
• In the near term, the useful fraud is not emptying your Revolut balance. It is someone else using a copy of your ID and address to open accounts, order credit, or pass identity checks in your name.
• You may get calls, texts or emails that already know your address, your date of birth, or that you bank with Revolut, and that offer to “help” with the leak. Treat unexpected contact as fake, even if it uses a government or Revolut name.
• If your notice mentioned statements or transaction history, those details can be used to sound like genuine support staff. Revolut will not ask you, out of the blue, to confirm a payment or to upload your passport again to “secure” this event.

What you can and cannot fix

The copies Revolut sent cannot be taken back. If a passport, driving licence, selfie, date of birth or home address was in that file, it is out. No bank, regulator or cleanup service can un-send it, and anyone who promises to delete it from the scammer’s hands is not telling you the truth.

What still helps is making that file harder to use, and cutting the extra personal detail that turns one leaked record into a full picture of your life.

• Do not send new copies of your ID, a selfie, or statements to anyone who contacts you about this. If you need to speak to Revolut, start from the app you already use or a number printed on a card you already own.
• Watch for credit, accounts, phone-number changes and official letters you did not ask for. That is the usual next step when copies of passports and licences have left a company.
• Assume the email address and phone number in the file will be used to reach you with fake “official” messages about this incident. Do not use links or numbers from those messages.
• Reduce what people-search and directory sites publish about you. A leaked Revolut record is a bundle of facts sitting on its own. It becomes much more dangerous when those sites bolt on relatives, extra phone numbers, employers and previous addresses. Unlike the stolen copies, those listings can often actually be taken down, which is why that step is worth doing even though it does not reverse the leak.