Hundreds of Revolut customers had personal data handed to a scammer by the bank’s own staff, according to reports published in September 2026. The fallout is a reported $3 million ransom demand and a public dispute over whether any demand was received. The episode reframes what is phishing beyond email links and shows how social engineering can bypass technical security.
💡 Frequently Asked Questions (FAQ)
- Q: What is phishing according to the Revolut incident?
- A: The incident shows phishing is not just fake email links; it is social engineering that can trick bank staff into handing over customer data, bypassing technical security controls.
- Q: How did Revolut staff hand data to a scammer?
- A: Reports published in September 2026 state the bank’s own staff provided personal data of hundreds of customers to a scammer, indicating an internal social engineering breach.
- Q: Did Revolut pay the $3 million ransom?
- A: A $3 million ransom demand was reported, but there is a public dispute over whether any demand was officially received or paid.