Revolut confirms customer data breach through fake government requests

How can this happen to a modern fintech... Esp. handling identity verification so poorly?

> A Revolut spokesperson confirmed to TechCrunch that a “limited” number of customers were impacted and said the company had contacted those customers directly. Revolut, however, did not disclose the exact number of impacted individuals. It also did not answer whether the incident was limited to a specific market and declined to disclose the government agency involved.

Is the lack of transparency here about protecting the doxxed HNWIs or are they just trying to hide the incompetence?

This is a 100% online bank account you typically open from an app. The typical clientele will just use the "selfie" auth.

My dialogue:

> Hi, me affected by your breach?

Them:

> "I have checked our records and can confirm that you have not received any notifications or communications regarding any security incidents or data breaches in the past 30 days.

> We take your privacy extremely seriously. All data transmissions between our mobile apps, servers, and third parties are fully encrypted, and your personal information is stored in secure data centres with restricted access. If there is ever any security incident that impacts your account, we will always contact you directly with instructions.

> Are you asking because you recently received a suspicious email, text message, or noticed an unusual transaction on your account? Let me know, and we can investigate that together."

... bot stuffs.

Most banks now require selfies, try shopping around. KYC requirements get tightened all the time.

> But they are verifying customers in person with account creation, this is an online bank

Revolut could do the same as they do with ATMs: make a partnership with local banks for the verification step.