# Revolut customers targeted by phishing texts and fake liveness-check page days after social-engineering data breach

> Revolut acknowledged on 2026-09-12 that a social-engineering attack, using fraudulent information requests from a spoofed Italian government email address, exposed identity documents, verification selfies and transaction histories of a limited number of customers (~650-700 reported). From 2026-09-14 a customer received a smishing text inside the genuine Revolut SMS thread linking to 93810.app, a page that requested camera access, mimicked Revolut's 'turn your head' liveness check, then asked for a password. Whether the phishing is tied to the breach is unconfirmed.

- **Published:** 2026-10-02T00:00:00Z
- **Last reviewed:** 2026-10-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2839
- **ID:** TL-2026-2839
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-12 Revolut publicly acknowledged that a social-engineering attack had exposed data of a limited number of customers. Per multiple reports, the attacker sent fraudulent information requests from an email address on a legitimate government domain (reported as an Italian government/regulator or law-enforcement address; The National and Euronews describe an Italian regulator / the Reggio Calabria prefecture mailbox, and a PEC sender on pec.interno.it was reported). The request reportedly passed SPF, DKIM and DMARC because it originated from a genuine government domain. No Revolut systems were breached: Revolut staff supplied the data in response to the fake request. Exposed data reportedly included identity and contact details, ID copies (passports, driving licences), verification selfies, account statements, transaction histories, IBANs and Bitcoin/wallet references. Revolut states customer funds and systems were unaffected, that it blocked the sender address and alerted authorities and regulators. Reported victim counts differ by outlet: Revolut confirmed about 680 European customers (Euronews); The National cites ~650; the extortionists claim at least 680 accounts, selected by blockchain analysis for large crypto holdings.

On 2026-09-17 a group calling itself 'iamnotavillain' posted a ransom demand of 6,000 XMR (about $3 million / EUR 2.61 million) with a 24-hour public countdown, threatening to sell the data otherwise, and claiming 147 GB taken from Italian law-enforcement systems (the law-enforcement compromise is an unverified claim). Reggio Calabria prosecutors reportedly opened an investigation. Infosecurity Magazine additionally reports the group used infostealer-log credentials to compromise Italian Ministry of Interior mailboxes with access held for ~6 months; this appears in a single outlet and is treated as unconfirmed.

The phishing campaign: from 2026-09-14 (two days after Revolut's acknowledgement) a customer received an SMS that appeared in the same conversation thread as genuine Revolut texts, urging the recipient to follow a link to confirm their identity or face account restrictions. The linked page, hosted on 93810.app (first scanned on VirusTotal 2026-09-14), requested device camera access, mimicked Revolut's 'turn your head' live-video identity check, and then prompted for the account password. This captures credentials and potentially selfie/video usable for identity fraud, account takeover or recovery-flow abuse. Malwarebytes (Pieter Arntz) stated it is unclear whether the phishing is connected to the breach or is opportunistic scamming exploiting the publicity. Inclusion in a genuine SMS thread suggests sender-ID spoofing, but the sources do not state the mechanism. No attribution of the phishing to the extortion group exists in the sources.

## MITRE ATT&CK

- T1586.002 Email Accounts
- T1583.001 Domains
- T1589 Gather Victim Identity Information
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1204.001 Malicious Link
- T1078 Valid Accounts
- T1657 Financial Theft

## Sources

- [Revolut phishing texts appear days after data breach (Malwarebytes, Pieter Arntz)](https://www.malwarebytes.com/?p=466329)
- [Revolut Customers Targeted by Phishing Campaign After Data Breach (Hackread)](https://hackread.com/revolut-customers-phishing-campaign-data-breach/)
- [Revolut Customers Targeted with New Wave of Phishing Attacks (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/revolut-customers-targeted-wave/)
- [Revolut customers' sensitive data exposed in phishing attack that fooled email security checks (Crypto Briefing)](https://cryptobriefing.com/revolut-phishing-attack-customer-data-exposed/)
- [Revolut faces $3M Monero ransom demand following customer data compromise (Parameter)](https://parameter.io/revolut-faces-3m-monero-ransom-demand-following-customer-data-compromise/)
- [Revolut hack: criminals steal data of 700 European clients, demand $3M ransom (Euronews)](https://www.euronews.com/business/2026/09/17/revolut-hack-criminals-steal-data-of-700-european-clients-demand-3m-ransom)
- [Revolut hack / data breach cyber (The National)](https://www.thenationalnews.com/future/technology/2026/09/21/revolut-hack-data-breach-cyber/)
- [Revolut hacker claims 147 GB stolen from Italian law enforcement (Pasquale Pillitteri)](https://pasqualepillitteri.it/en/news/16288/revolut-hacker-italian-law-enforcement-147gb)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2839