Reuters reported on 12 September that Revolut disclosed sensitive customer information to an unauthorised party after fraudulent requests appeared to originate from a legitimate government-agency email domain. Revolut confirmed the incident and said it was cooperating with authorities. Reuters did not report this as a compromise of Revolut’s core banking systems.
The case is useful because it exposes a weakness between channel trust and authorisation. An apparently legitimate institutional channel can still carry a request from someone who is not entitled to receive the information. Proving where a communication appears to come from is not the same as proving the requester has legitimate authority.
That problem becomes more important as enterprises begin allowing AI agents to act through real credentials, APIs and institutional workflows. An agent may be correctly authenticated and still be compromised, incorrectly delegated or operating outside its mandate.
Reuters later reported, citing the Financial Times, that attackers claiming responsibility threatened to sell customer records unless Revolut paid $3 million. Revolut told Reuters it had received no direct contact or demand from the group. Reuters also cited a source familiar with the matter saying roughly 680 customers were affected and that Revolut’s core infrastructure, databases and customer accounts were not hacked.
Those distinctions are important. Claims made by an attacker, facts confirmed by Revolut and information reported by Reuters from sources are different categories of evidence and should not be collapsed into one account.
For banks, the broader lesson is that trust should attach to authority, not merely to an apparently legitimate channel.
