Revolut confirms attackers extracted customer data by impersonating government agencies.

Revolut said on September 12 that customer data was disclosed in response to fake government and law-enforcement requests, and notified affected customers plus the relevant agency, law enforcement and financial regulators. Emergency-disclosure channels are trust-by-letterhead. A language model makes forging convincing agency correspondence at volume close to free, and there is no cryptographic verification step in most of these workflows. If you operate one, the control is out-of-band callback to a published number, not document review.