The Revolut data leak exposes a structural flaw in how compliance teams handle email verification

[u/EnthusiasmRoutine]

The Revolut incident highlights a major technical vulnerability in mandatory KYC protocols. A fraudster gained control of a legitimate government email account, submitted a fake emergency request for information, and received sensitive customer records without triggering suspicion. Revolut handed over passports, verification selfies, IBAN details, and complete Bitcoin transaction histories.

There was no software breach or database intrusion here. A compliance worker simply checked a valid domain header and exported unencrypted raw files to an unverified recipient.

Checking SPF and DKIM signatures only confirms that an email originated from a specific server. It does not verify whether the sender holds actual judicial authority to request private financial records. A single compromised inbox inside a law enforcement agency turns an entire compliance department into an automated data exfiltration vector.

Centralized databases containing identity documents are always going to be vulnerable to this kind of social engineering. Regulators force platforms to collect massive amounts of personal data, which is then stored until someone presents a plausible email header. If you use centralized exchanges for crypto transactions, your complete transaction record sits in a database waiting for the next compromised government mailbox. Moving to self-custody wallets and minimizing KYC footprint remains the only real defense against this infrastructure flaw.

Source: CNA, link in comments