Irish Revolut customers warned as fraudsters obtain passport and driving licence scans
ESET Ireland has warned that ‘leaked passports do not expire’
Revolut has told some of its customers that copies of their passports and driving licences, along with their dates of birth, home addresses, email addresses and phone numbers, were handed to criminals.
The company has not said how many people, or where they live, but cybersecurity firm ESET Ireland says anyone with a Revolut account in this country should assume for now that they could be one of them.
The breach was not a hack in the usual sense. According to Revolut, the requests for the data came from a genuine government agency email domain and were dealt with as genuine.
READ NEXT: Temperatures to hit 24 degrees in some parts today but experts pinpoint dramatic turnaround
Revolut has described the number of customers involved as limited and says it has contacted each of them directly. It has declined to name the agency.
Revolut had 3.4 million customers in Ireland at the last count in June, its own figure. Most Irish adults have an account, even if only for splitting a bill.
The reason ESET Ireland is worried is not the leak itself. It is what the leaked material is good for.
A password gets reset in a minute. A passport scan does not, and a scammer who holds someone’s date of birth, address, mobile number and photo ID can make a phone call that sounds completely legitimate, because every detail they quote is right.
“The call will come from someone claiming to be Revolut’s fraud team, and they will know things about you that only your bank should know,” said George Foley, cybersecurity specialist for ESET Ireland.
“That is how they get past your guard. Then comes the bit that costs you money. Your account has been compromised, they say, so move your balance to this safe account while we sort it out. There is no safe account.
“Revolut will not ring you and ask you to move money, and neither will AIB, Bank of Ireland or the Gardaí. If you get that call, hang up, open the app and message them yourself.”
ESET Ireland is warning that the stolen documents could also be used to open accounts or apply for credit in other people’s names, which may not surface for months.
Anyone who received a notification from Revolut should check their credit record with the Central Credit Register, which is free, and consider replacing the affected document if Revolut confirms an ID copy was included.
There is a second warning in this for Irish businesses. Firms that hand over personal data to Revenue, the Gardaí, the HSE or a local authority on request should ask themselves how they would know if the request was real.
“Whoever did this worked out that they did not need to break in,” said Foley. “They got hold of a real government email account and asked politely, and a compliance team somewhere did its job and answered.
“A genuine sender address is not the same as a genuine request. If someone asks you for sensitive data by email, ring them back on a number you already have, not the one at the bottom of the message. It is a five minute call. Revolut is now finding out what it costs to skip it.”
For more information visit www.eset.com/ie/.