Just saw that a few day ago Revolut confirmed that someone sent it data requests from a real government agency email domain. The requests were fake. Revolut answered them anyway.
They sended: names, dates of birth, home addresses, passport and driving licence scans, verification selfies, IBANs, account statements and transaction histories. Revolut says only a "very limited group" of customers was affected and no passwords or funds were touched.
I keep thinking about what I'd do if I got that notification email.
What would you do?
If you work in a bank or fintech, what happens at your company when a request claims to come from the police or a regulator?
And should a bank send out passport scans and selfies because an email asked for them, even if it looks official?
Source: r/fintech · by /u/Abject_Ask5000