Fraudsters fooled Revolut – could they fool your business?

Your bank data is a goldmine for criminals

They didn't hack the bank – they fooled it! 680 Revolut customers have sensitive data exposed after fake official requests

Here's the frightening bit about the Revolut data breach: the criminals apparently didn't have to break into Revolut's systems. They used what appeared to be a legitimate government email channel and persuaded the company to disclose sensitive customer information. Around 680 customers were affected, with data potentially including identity documents, addresses, account information and transaction histories. For every small business owner, there's a simple lesson: today's fraudsters don't necessarily need to hack you when they can impersonate somebody you trust.

HACKED

Your small business is on the line when your bank’s data is stolen

680 Revolut customers have had identity documents, account details and full transaction histories exposed. Criminals are leaking data and demanding a huge ransom. For small businesses, this is a wake‑up call.

The Revolut breach is one of the most serious fintech incidents in years. Hackers impersonated a real government agency, tricked Revolut into releasing sensitive customer data, and are now leaking documents and demanding ransom payments.

Around 680 customers were affected. That may be a tiny share of Revolut’s global customers, but the type of data exposed is exactly what criminals use to target small and micro businesses: identity documents, addresses, IBANs, account statements, withdrawal records and full transaction histories.

Details

When criminals get their hands on business banking data, they have everything they need to launch highly targeted attacks. With IBANs, transaction histories, addresses and KYC (Know Your Customer) documents exposed, criminals can impersonate your business to banks, suppliers or payment processors.

Fraudsters use stolen data to send “updated bank details” that look legitimate. This is one of the fastest‑growing scams against small firms. Transaction histories reveal who you pay and when; allowing criminals to mimic suppliers with perfect timing.

With identity documents and email details leaked, scammers can impersonate founders or finance staff to request urgent payments. Victims of the Revolut breach have already reported blackmail attempts using stolen data.

Full transaction histories allow criminals to craft personalised, believable messages that bypass your usual scepticism. For a micro‑business, one successful scam can wipe out a month’s revenue at best and the entire company at worst.

Red Flags

Based on the breach details and common fraud patterns, there are red flags. If any of these appear, assume your business is being targeted.

Requests to change supplier bank details, especially if they match real payment timings or invoice amounts.

Emails that appear to come from government agencies or regulators. The Revolut breach exploited a legitimate government email domain.

Urgent payment instructions from senior staff: this is the classic “CEO fraud”, especially if the tone feels slightly off.

Customers claiming refunds or chargebacks you weren’t expecting - criminals use stolen identity data to impersonate customers.

Login alerts, password reset emails or new device notifications may look legitimate but may not be,

Blackmail or extortion messages referencing real transactions are real attempts at blackmail or extortion. Victims of the Revolut breach have already received these.

Protect Your Accounts

Make sure you have multi‑factor authentication everywhere. This is the single strongest defence against account takeover.

Use dual‑authorisation for payments; no invoice or bank detail change should ever be approved by one person.

Verify all payment‑related requests through a second channel: call the supplier using the number you already have and never the one in the email.

Lock down access to financial systems: limit who can view statements, export data or approve transfers. There could even be a scammer’s assistant on your team.

Train employees on impersonation scams. Scammers now use stolen documents, selfies and addresses to appear legitimate and employees can get caught out.

Monitor your accounts every day. Look for small test transactions because criminals often try out your defences before they attack.

Use virtual cards for online purchases: Revolut Business recommends this as a protective measure.

Report suspicious activity immediately: speed increases the chance of freezing fraudulent transfers.

Review your data‑release procedures. The Revolut breach happened because a fraudulent request looked official. Ask yourself and anyone else on the team: Would we fall for the same trick?

Warning Shot

Criminals don’t need to hack your systems; they just need enough stolen data to impersonate you, your suppliers or your customers. Once they have it, the attacks become more convincing, more targeted and more damaging.

Assume that if your small business bank details exist, they can be stolen. If they’re stolen, they will be used and if you’re not prepared, your business is in danger of being shut down.

Strengthen controls, verify everything, train your team and treat every financial request, no matter how official it looks, as suspicious until you’ve checked and checked again that it’s legitimate and safe.