Fintech firm releases customer identity files to a fraudulent government request

A Revolut spokesperson confirmed to a TechCrunch journalist that it disclosed customer data to an unauthorized third party after receiving fraudulent information requests from what seemed to be a legitimate government agency's email domain. According to the customer notification, the request carried valid domain authentication credentials and was fulfilled "under the reasonable belief that it was an authentic government agency request." The exposed data reportedly included dates of birth, postal and email addresses, phone numbers, and copies of passports or driver's licenses, and may also have included verification selfies, account statements, and transaction histories.

ASSESSMENT

The FBI has warned previously that criminals were using compromised US and foreign government email accounts to submit fraudulent emergency data requests to US-based companies, exposing customers' personal information for further criminal use. Replacing a document or account does not retrieve the identity material and transaction history already disclosed. Researches have suggested the request appeared aimed at high-net-worth users.

TAKEAWAYS

• Families using fintech and digital-asset platforms should determine what identity material each platform holds

  
  

• Discuss how your family would respond if a provider disclosed identity documents, including document reissue, KYC docs, tax filing, and address exposure review

  
  

• Ask banks and platforms that store your sensitive information how they authenticate government and law enforcement requests beyond checking the sender's domain.

  
  

Source: TechCrunch