Has Revolut Had a Data Breach? What Expats Need to Know
- Official sources checked
- Written by Sue Berry
- Practical guidance
Published 15 September 2026
Revolut has confirmed the incident. However, it is important to distinguish the confirmed Revolut data breach from exaggerated claims circulating online. Revolut says a limited number of customers were affected and that its banking systems and customer funds were not compromised.
Revolut initially described the number affected as limited. Subsequent reporting by the Financial Times on 15 September says 680 customers were notified that their information was affected.
Listen to this Secret
Hear “Has Revolut Had a Data Breach? What Expats Need to Know”
Choose a natural-sounding English voice and a comfortable reading speed from those available on your phone, tablet or computer.
Ready to listen.
Nothing plays automatically. Screen-reader users can continue to use their usual reading controls.
The Quick Answer
Yes. Revolut has confirmed that sensitive information belonging to a limited number of customers was disclosed to an unauthorised third party.
However, this does not appear to have been a traditional hack into Revolut's banking systems.
According to Revolut, fraudulent requests for customer information were sent using an email account on a legitimate government-agency domain. The requests appeared genuine and customer information was released in response.
Revolut says its systems were not compromised and customer funds were not affected.
The most important thing for Revolut customers now is not to panic, but to check whether Revolut has contacted them and be particularly alert for convincing scams that may use genuine personal information.
Why This Matters
You may have seen headlines or social media posts suggesting that Revolut has suffered a huge data breach.
There has been a genuine security incident, but it's important to separate what has actually been confirmed from some of the more dramatic claims circulating online.
Revolut has confirmed that an unauthorised third party obtained sensitive information relating to some customers.
But criminals apparently didn't break into Revolut's banking systems.
Instead, fraudulent requests for customer information were sent using an email account associated with a genuine government-agency domain.
This made the requests appear legitimate.
Revolut provided information believing that it was responding to a genuine official request.
It later discovered that the requests were fraudulent.
Revolut says it blocked the email address involved and notified the relevant government agency, law enforcement, regulators and data-protection authorities.
The company has also said that affected customers have been contacted directly.
What Information Could Have Been Exposed?
The information involved appears to vary between customers.
According to reports based on notifications sent to affected customers, information potentially disclosed may include:
Full name Date of birth Home address Telephone number Email address Passport or driving-licence copies Identity-verification selfies IBAN information Account statements Withdrawal information Transaction histories Bitcoin transaction information
This does not mean every affected customer had all of this information exposed.
It also doesn't mean that every Revolut customer has been affected.
Is My Money at Risk?
- Revolut says customer funds were not affected by this incident.
- There is currently no evidence from this particular incident that criminals gained general access to Revolut accounts or were able to remove customers' money.
- That means there is currently no reason to rush to withdraw or transfer your money simply because you've heard about the breach.
- The more immediate concern is what criminals might subsequently do with personal information.
- Why Could This Be Particularly Important for Expats?
- Expats often have a more complicated financial footprint.
- For example, you might:
Live in Spain
Receive a UK pension Have a Spanish bank account Have a UK account
Use Revolut or Wise
Transfer money between countries Have both UK and Spanish telephone numbers Deal with authorities in more than one country
Imagine receiving a telephone call from someone who already knows your full name, address, date of birth and that you have a Revolut account.
They might say:
"We're calling from Revolut because your account was involved in the recent security breach."
They could even know genuine information about you.
That can make the call sound extremely convincing.
But knowing personal information about you does not prove that the caller is genuine.
Important — Read Before You Act
This isn't a reason for every Revolut customer to panic.
It is a reason to be more alert.
The biggest danger may not be someone suddenly accessing your Revolut account.
It could be a scammer contacting you later armed with enough genuine personal information to make you believe they're from your bank, the police, a government department or another organisation you trust.
So remember:
- Someone knowing information about you doesn't prove they are who they say they are.
- Stop.
- Check.
- Contact the organisation independently.
What To Do — Step by Step
Step 1 - Open your Revolut app. Don't use a link from an email, text message or social-media post. Open the Revolut app yourself. Check your notifications and messages to see whether Revolut has contacted you about the incident.
Step 2 - Check your email. Check the email address registered with your Revolut account. Look for any notification telling you that your information was involved. Remember that scammers may also start sending emails pretending to be Revolut because this breach is now public knowledge. Don't assume an email is genuine simply because it mentions the breach.
Step 3 - Don't respond to unexpected security calls. Be particularly careful if someone telephones you claiming to be from Revolut. If you're uncomfortable with the call, end it. Then open the Revolut app yourself and contact Revolut independently.
Step 4 - Never transfer money to a "safe account".A genuine-looking scam could tell you: "Your Revolut account has been compromised. We need to move your money into a secure account." Don't do it. The idea of moving money to a "safe account" is a common scam technique.
Step 5 - Check your transactions. Look through your recent Revolut activity. If you see anything you don't recognise, contact Revolut through the app.
Step 6 - Keep any breach notification. If Revolut tells you that your information was involved, keep a copy of the notification. This may be useful if there are further developments or you later experience attempted identity fraud.
Step 7 - Be more cautious than usual. For the next few weeks and months, treat unexpected calls, emails and text messages concerning Revolut with particular care. A scammer may know genuine information about you. That still doesn't mean they're genuine.
Common Mistakes to Avoid
- Mistake 1 - Assuming an email is genuine because it looks professional. Logos, colours and convincing wording are easy to copy. An email mentioning your real name or other personal details isn't necessarily genuine either. Safer option: Don't use the link in the message. Open the Revolut app yourself.
- Mistake 2 - Trusting someone because they know information about you. This is particularly important after a data breach. A caller knowing your name, address, date of birth or even something about your finances does not prove they work for Revolut. Safer option: End the conversation and contact Revolut independently.
- Mistake 3 - Acting quickly because you're frightened. Scammers often create urgency:"Your money is being stolen." "Your account will be frozen." "You need to act immediately." Fear makes us more likely to act before checking. Safer option: Stop. Don't transfer anything. Check independently.
- Mistake 4 - Moving money to a "safe account" If someone unexpectedly tells you that your money needs to be transferred elsewhere to protect it, treat this as a major warning sign.Safer option: Don't make the transfer. Contact your bank or Revolut yourself.
- Mistake 5 - Giving out a security or verification code. A caller may claim they have sent you a code to "confirm your identity". That code could actually be what they need to access or authorise something on your account. Safer option: Never give an unexpected caller a security code.
- Mistake 6 - Assuming you're safe because nothing has happened yet. Stolen personal information can remain useful to criminals for a long time. A scam attempt might arrive weeks or months after the original incident. Safer option: Stay alert to unusual contact rather than assuming the danger has passed.
- Mistake 7 - Believing everything shared on social media. Real security incidents often become mixed with rumours, exaggerated figures and old stories. Safer option: Check information against Revolut, regulators and reputable news sources before taking action.
Your Action Checklist
- Do now
- Open the Revolut app directly
- Check for any message or notification about the incident
- Check the email address registered to your account
- Review your recent transactions
- Keep a copy of any notification saying your information was affected
- Protect yourself
- Don't click unexpected Revolut security links
- Don't share verification or security codes
- Don't transfer money to a "safe account"
- Be suspicious of unexpected calls about the breach
- Remember that caller ID can be misleading
- Contact Revolut independently through the app if you're unsure
- If Revolut confirms your information was affected
- Read exactly what information Revolut says was disclosed
- Save the notification somewhere safe
- Follow the security instructions Revolut gives you
- Be particularly alert if identity documents were involved
- Watch your financial accounts for activity you don't recognise
- Keep a record of suspicious calls, messages or emails you receive
Frequently asked questions
Has Revolut actually been hacked?
Not in the traditional sense, according to the information currently available.
Revolut says its systems were not compromised.
Instead, fraudulent requests for customer information appeared to come from a legitimate government-agency email domain, and information was disclosed in response.
Has every Revolut customer been affected by the Revolut data breach?
No.
Revolut has described the number affected as limited.
It has not publicly confirmed exactly how many customers were involved.
Will Revolut tell me if my information was involved?
Revolut says affected customers have been contacted directly.
Check your Revolut app and your registered email address.
Should I move my money out of Revolut?
There is currently no evidence from this incident alone that you need to.
Revolut says customer funds were unaffected and its systems were not compromised.
Don't make a rushed financial decision because of frightening headlines.
What if someone from Revolut phones me about the breach?
Don't rely on the telephone number displayed on your phone or information the caller knows about you.
You can simply end the call and contact Revolut yourself through the official app.
What if they know my name, address or date of birth?
That doesn't prove they're genuine.
Personal information can come from data breaches, public records, social media and other sources.
This particular incident demonstrates exactly why knowing information about you should never be treated as proof of identity.
What if I live in Spain but use Revolut for my UK pension or spending?
The same advice applies.
Having accounts, income and financial arrangements across different countries can actually make a convincing scam sound more believable.
Don't allow an unexpected caller or message to rush you into taking action.
Contact the organisation independently.
Further Reading
In Summary
The Revolut data breach is real, but it is important to keep it in perspective. Revolut says a limited number of customers were affected, its banking systems were not compromised and customer funds were not affected.
For customers, the sensible response is to check whether Revolut has contacted you, review your account and be particularly careful about unexpected calls, emails or messages. A scammer knowing genuine information about you does not mean they are genuinely from your bank.
There is no need to panic. Take sensible security precautions, stay alert and continue to check information through official sources.
Sue’s final thoughts & experiences
A personal note from Sue Berry
I have used Revolut since its early days and, despite this incident, I still consider it an extremely safe and useful bank.
Personally, I have always had great service from Revolut and I value the benefits it gives me, particularly as someone living abroad and managing money across different countries.
Any leak of personal information is worrying and should be taken seriously. But I don't think the answer is to become frightened of using digital banking. We need to understand the risks, use the security measures available to us and remain alert to scams, while also recognising the very real benefits these services provide.
No bank or financial service can promise that a security incident will never happen. What matters is how an organisation responds, what it learns and what changes it makes afterwards.
I hope this incident results in even stronger checks and security at Revolut.
For me, it hasn't changed my decision to use Revolut. I'll continue using it — but, as with every financial account I have, I'll continue taking responsibility for the security measures I can control too.
That's the balance I think we need: be aware, be careful, but don't let fear stop us benefiting from useful technology.
Checked sources and useful services
Sources for this Secret
- Revolut Help Centre — The best starting point for Revolut customers who want to check security information or contact Revolut about their own account.
- INCIBE – Spain's National Cybersecurity Institute — Particularly useful for expats living in Spain. INCIBE provides advice about phishing, identity theft, online fraud and other cybersecurity problems.
- INCIBE 017 Cybersecurity Helpline — A free and confidential Spanish national service. You can call 017, use WhatsApp on 900 116 117, or contact them through their online form. The service operates from 8am to 11pm, 365 days a year.
- INCIBE – What to do if you've experienced fraud — Useful guidance if you believe you've actually become a victim rather than simply receiving a suspicious message.
- UK National Cyber Security Centre — Official UK cybersecurity guidance, particularly useful for British expats who still have UK accounts, telephone numbers or other UK financial connections.
Relevant official starting points
Official information related to this Secret
Only countries and areas with guidance relevant to this subject are shown. Always check the latest information with the authority responsible for your circumstances.
No subject-specific official link is currently listed for this Secret.
No subject-specific official source is currently listed for: United Kingdom, United States, Germany, Ireland, Italy.