We’d like to remind Forumites to please avoid political debate on the Forum.
This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.
Revolut handed customers ID including passports to scammers
Interestingly, this happened on the same day I suggested that customers being forced into repeated invasive ID checks [Santander ] push back eg. by changing accounts, writing to MPs responding to call outs by organisations fighting data accumulation or whatever.
Revolut sends out passports and Bitcoin records to a fake email. What to do now
If you bank with Revolut you need to find out if you have been affected.
Comments
-
This appears to be a serious data breach involving:
Passport or driving-licence copies and the selfie used for identity checks sat in the pack. So did full name, date of birth, occupation, home address, email and phone number. Account statements listed IBANs, opening dates, withdrawals and the full payment trail, Bitcoin included.
We have to assume that information that any bank holds about us is also known to scammers.
A scan of a passport plus a matching face photo is enough for someone to open accounts, apply for credit or apply for a SIM swap.
The banks will know about this breach. I expect that scammers will have difficulty in opening accounts or obtaining credit with only this data. My mobile network provider will only send replacement SIMs to the same address as the original one, so no luck there.
0 -
A scan of a passport plus a matching face photo is enough for someone to open accounts, apply for credit or apply for a SIM swap
It isn't actually enough for an application for a financial account. Each time I have been asked to upload a passport or DL scan, I have also been asked for a live recording of my face.
Pretty dreadful, but not entirely unexpected, that Revolut has lost customer data to a scammer. What's not clear from the article is which country or countries are affected - Revolut operates in dozens of countries, so it is not entirely clear whether UK customers are affected. Apparently a Revolut spokesperson confirmed to TechCrunch that a “limited” number of customers were impacted and said the company had contacted those customers directly so you can relax if you haven't heard from Revolut. Personally, I am happy that I closed my Revolut account a while ago, even though they had eventually managed to obtain a UK Licence after years of trying.1 -
People should not downplay the significance of this breach, even if it does not constitute a complete dataset needed to commit fraud, it is both serious and significant, and will assist any scammers who can marry it with other data.
At this point it seems the first actions would be to identify whether you are among those affected by this serious failure.
Ultimately, for those whose data is stolen CIFAS registration may be something to consider, but this move may also affect your own ability to open accounts and use financial services.
1 -
Like you, I am far from persuaded that the data we are being compelled to disclose to third-parties is sufficiently secure, and I'm of the view that KYC requirements may actually be contributing to the problem whilst having a very limited impact on organised crime.
1 -
It isn't actually enough for an application for a financial account. Each time I have been asked to upload a passport or DL scan, I have also been asked for a live recording of my face.
A live recording of your face would not be a problem for professional scammers. Given a selfie, they could use AI to generate a fake live recording of your face. The recording only has to be good enough to fool a human scrutineer. Hopefully, there will be other checks of your identity.
0 -
I do remember being politely mocked not so long since when I suggested that giving everything short of our DNA code to companies who share it with anyone who asks is not a good idea. No no, I was told, it's all necessary and stored very securely. And here we have a mainstream bank that is happy to send off definitive customer data to literally anybody who emails and asks for it.
6 -
Revolut is hardly what I would consider a mainstream bank. Though not even Revolut have sent customer data to literally anybody who emails and asks for it. Chill a bit.
4 -
So the 7th most popular bank in the UK with 13 million customers can't be classed as 'mainstream'? Interesting.
And if you're willing to indulge a little hyperbole, common in informal speech, my statement about the email is valid. It would have taken them five minutes to pick up a phone and confirm whether the email was genuine yet they didn't bother and, after doing nothing more than checking some easily spoofed information in the email header, sent critically important customer identity data to a fraudster.
Perhaps it was you who politely mocked me. That would go some way to explaining your post.
1 -
The Competition & Marketing Authority's list is about as reasonable definition as you will get of a mainstream Bank:
I do not believe that your campaign for a relaxation in money laundering and fraud prevention checks is likely to succeed any time soon.
1 -
TBF, that IPSOS survey was for last (calendar) year, Revolut didn't get their UK banking licence until earlier this year so wouldn't have featured in this survey of 'personal banks'.
2
Confirm your email address to Create Threads and Reply
Categories
- All Categories
- 355.7K Banking & Borrowing
- 254.9K Reduce Debt & Boost Income
- 456.1K Spending & Discounts
- 248.3K Work, Benefits & Business
- 605.9K Mortgages, Homes & Bills
- 179K Life & Family
- 263.7K Travel & Transport
- 1.5M Hobbies & Leisure
- 16.2K Discuss & Feedback
- 37.7K Read-Only Boards