REVOLUT HANDED PASSPORTS, SELFIES, ADDRESSES AND FULL BITCOIN HISTORIES TO A FAKE GOVERNMENT REQUEST — THE EMAIL CAME FROM A REAL GOVERNMENT DOMAIN AND PASSED EVERY CHECK — REVOLUT VERIFIED IT AFTER THE FILES WERE GONE

Revolut says it “recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.” Read the middle of that sentence twice. Not a lookalike address. A real government domain, with someone inside it who should not have been there.

So the email passed. It would pass at your bank too. Revolut answered the request, then separately contacted the agency to confirm it, and found out what it had done. The order is the story: send, then check. The files were already out.

Here is what was in them, as CoinDesk reads the notice: passports or driving licences, the verification selfie, name, date of birth, occupation, home address, email, phone, IBAN, account statements, withdrawal records, and the full transaction history including every bitcoin movement. Revolut has not said how many customers. ZachXBT, who posted it on Telegram Friday night, says it looks limited and aimed at high-net-worth accounts.

Put those two facts together. Somebody chose the targets, and now holds a file that says who they are, where they sleep, what they look like, and what they moved. That is not a breach the way a leaked password list is a breach. It is a shopping list.

Be fair to Revolut. Funds were not touched. It notified customers, the agency, law enforcement and regulators, and blocked the sender. And any bank on earth has to answer a lawful request from a government domain; that is the deal a bank signs. The failure is one step in one process, and it is the step every institution is under pressure to skip: verify before you send. Revolut did it after.

Now the part that is ours. Everything on that list is what you handed over to get in. It is the price of the account, and it sits there as long as the account does, waiting for someone with a convincing email. The one line in that file that cannot hurt you is the bitcoin that left. A withdrawal to an address you control shows up as an exit, not a balance. Not your keys, not your coins has a twin: not your data, once you have given it away. Keep the on-ramp small. Keep the balance somewhere a government email cannot reach.