When a company is breached and personal customer data is leaked, companies always send the same lame message to their customers, but they rarely answer the full questions in need of answering.
Recently, Revolut experienced a data breach where an employee mistakenly handed over the passports, driving licences, identity verification selfies, and account histories for roughly 680 customers, after clearing a fraudulent request sent from a legitimate government agency’s email domain.
While the company says its systems were never breached and customer funds were left untouched, it ignores the fact that this other information was still stolen. Whereas a password reset fixes a login, nothing can reset leaked Identity document information. This post looks at why that kind of data doesn’t expire, and what identity verification has to lean on once documents and selfies can’t be trusted alone.
What Revolut actually lost, and why the framing matters
The exposed data included customers’ identity and contact details, including birth dates, postal and email addresses, and phone numbers, along with copies of passports and driver’s licenses; verification selfies, account statements, and transaction histories may also have been included. A group calling itself Revolut Smilik has claimed responsibility, is demanding 10,000 bitcoin, and has threatened to leak more files daily if it isn’t paid. The UK’s Financial Conduct Authority and Information Commissioner’s Office are both now involved.
The craziest part is, this all didn’t occur because of a broken firewall or hacking incident. It was simply the result of authorization failure. A domain that looks legitimate made a request that appeared routine and went through without proper checks and balances stepping in to stop it. That is a more uncomfortable failure mode for every Trust and Safety team to sit with because it means the weak point wasn’t the target company’s infrastructure, but merely a human decision about whether to trust a sender.
A KYC file doesn’t expire
While login credentials can be reset or credit cards can be canceled and reissued, a leaked KYC file doesn’t share that same luxury. Once sensitive data like a passport number, a date of birth, or a selfie matched against that exact document are leaked, they’ve been leaked forever. These pieces combined are enough for fraudsters to pass a knowledge-based verification question at an entirely unrelated company, pre-fill a credit application, or make a follow-up phishing attempt feel bureaucratically legitimate because the attacker already has the paperwork to back it up.
That is the part of this story that outlasts the news cycle. Revolut will patch its intake process. The documents that have already been leaked are still identity assurance material for anyone who buys them.
The math other platforms should already be doing
This isn’t Revolut’s problem to solve alone, as Revolut’s affected customers don’t exclusively bank with Revolut. Every other platform where those customers hold an account, especially ones that lean on a document check and a selfie for verification, inherits some of this exposure the moment that data starts circulating.
That inheritance is measurable. Across the Sift Global Data Network, 22% of U.S. consumers reported experiencing account takeover in the past year, and users tied to fraudulent chargebacks showed 15.8 times higher Mean Global Linkage than typical users, meaning fraud rings increasingly show up as connected clusters of accounts and devices rather than isolated incidents. A batch of real, verified identity documents dropped into that economy doesn’t get used only once, but everywhere it can still pass a check.
Why the document-and-selfie check was already the wrong finish line
Even without a single breach, document-and-selfie verification was losing ground. Estimated U.S. economic losses from synthetic identity fraud are projected to reach $30 billion to $35 billion annually, and 8.3% of digital account creations were suspected fraudulent in the first half of 2025. A leaked, genuine KYC file makes that problem worse in a specific way, since it doesn’t just supply fabricated data to blend with real fragments. It supplies an entire real identity, document and face included, for someone else to reuse.
A document and selfie check answers one question, does this look like a real document paired with a matching, live face? It was never built to answer the question that actually matters after a breach like this one, is the person presenting that document and face the same person they belong to? Static, document-and-selfie-first verification treats a good forgery and a stolen genuine pair the same way, because both can look equally convincing to a check that only confirms internal consistency rather than who’s actually standing behind them.
What has to replace a static document check
Verification that depends only on artifacts a breach can copy will always be a step behind the next breach. The signals worth building on are the ones that don’t travel in a leaked file, such as how a device has behaved across multiple sessions and accounts, whether an identity resolves into the same connected profile a network has already flagged, and whether the behavior around an application matches a real, continuous relationship with an account rather than a first-time, document-perfect setup.
Resolving identity and risk signals across a network in near real time, rather than re-verifying the same static artifacts at every touchpoint, is a fundamentally different kind of defense than a document check. So is device intelligence that recognizes a device across sessions and platforms, rather than trusting whatever paperwork it presents. None of this reduces a person to a single verdict. The better versions of this approach aggregate thousands of signals across a user’s journey into one score that shifts in real time as new signals arrive, landing somewhere between trustworthy and likely fraud rather than a fixed, one-time judgment.
What to check this week
Start with the enrollment and recovery flows where a document plus a selfie is still treated as sufficient proof on its own. Layer in device and behavioral signals so a stolen-but-genuine document has to clear more than one static gate. And watch for the early tells of reused stolen data, including a sudden cluster of applications with clean, consistent documents but new, unrelated devices and thin account histories.
Read more about how Sift stops account takeover in real time, even when the identity behind the login was never stolen from you.
Frequently asked questions
Does this only put Revolut customers at risk?
No. The documents and selfies that were exposed can be reused on any platform that verifies identity primarily through a document check, regardless of whether that platform banks with Revolut, which is what makes this leak so dangerous.
Is multi-factor authentication enough to stop what comes next?
MFA helps prevent someone from logging into an existing account, but it does little against new-account fraud, where an attacker isn’t breaking into an account at all. They use the stolen information to open a new account somewhere else using someone else’s real, leaked documents.
What’s the first thing a fraud team should change?
Identify every flow that still treats a valid-looking document and a matching selfie as sufficient proof by itself, and add device and behavioral signals as a second, independent check before anything is approved.
