BTW, @Revolut confirmed it disclosed customer information after receiving fraudulent requests from an email address using a legitimate government agency domain. The exposed information reportedly included identity documents and may also have included verification selfies and transaction histories. Revolut says customer funds were unaffected, but that doesn’t make the exposure harmless. Those details could help someone impersonate a customer or make a scam message much more convincing. I think we should be asking for a proper explanation of how those requests passed their checks, what they’ve changed, and what support affected customers will receive instead of blanket statements.