Story 80September 1–14, 2026
Revolut says fraudulent government-style requests exposed customer information
Revolut confirmed that an unauthorized party obtained sensitive customer information after sending fraudulent requests from a legitimate government-agency email domain.
Content note: This story includes crime. Keep discussion focused on the evidence; students do not need to share personal experiences.
What happened
Revolut confirmed that an unauthorized party obtained sensitive customer information after sending fraudulent requests from a legitimate government-agency email domain. TechCrunch reported possible exposure of identity documents, addresses, phone numbers, birth dates, selfies, statements, and transaction histories; Revolut said a limited number of customers were affected but did not give a count.
Why this date is used: investigation · September 12, 2026
The pieces to keep in view
Turn the facts into a thought
Expository
Explain impersonation, domain trust, data minimization, and independent verification of requests.
Original oratory
Financial institutions should verify authority through a second channel before releasing intimate customer data.
Why it matters
People may face identity theft, targeted fraud, and financial privacy harms, while banks must reassess how they verify official-looking data requests. The incident affects more than 80 million Revolut customers indirectly through trust in the company's controls.
What is unusual
The attack reportedly used the reputation of a real government email domain as a key to unlock private financial information.
A judge may ask
Detailed verification procedures can slow urgent legal investigations and expose institutions to conflicting obligations.
Strengthen the reasoning
Propose a risk-based process with emergency exceptions, dual approval, audit logs, and a direct callback to a verified agency number.
Suggested age
12+ guidance
For younger students
Role-play a caller asking for a class list and practice calling the school office using a known number first.
Discussion starter
How can you check whether an important request is really from the person it names?
Sources and limits
Revolut did not identify the government agency, affected market, or exact number of customers, and said customer funds and core systems were unaffected.