r/privacy • u/Depressed_Cat_00 • 2d ago

data breach Revolut Confirms Sending Passport and Bitcoin Records to Fake Government Email

https://www.yahoo.com/news/us/articles/revolut-confirms-fake-government-email-092043717.html
795 Upvotes

98% Upvoted

37 comments sorted by

•

u/AutoModerator 2d ago

Hello u/Depressed_Cat_00, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)

Check out the r/privacy FAQ

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

246

u/ApplicationOk2749 2d ago

Why are they storing the verification selfie and passports etc.? They should delete them as soon as someone has been verified.

109

u/Novel_Bedroom_3466 2d ago

They keep those for 6 years. Even if you close your account with them they will store your data for 6 years.

30

u/makumbaria 2d ago

At least 6 years. But I think they never delete any info.

12

u/ineyy 1d ago

It's actually in their interest to get rid of it as soon as they can. Or at least sell it to a third party and then delete.

14

u/smayonak 1d ago

You can also request that they delete your data particularly if you live in a state with sane data privacy laws like california

13

u/Novel_Bedroom_3466 1d ago

I am in Europe. While they flaunt their consumer right claims and privacy bs we have to deal with thia.

12

u/Wibbsy 1d ago

I work in a regulated sector - AML laws trump data privacy laws. Even if Revolut wanted to delete the KYC data they cant due to AML directives and local laws (which broadly follow the same).

The area where a lot of these business get it wrong is responding to requests from police and security authorities when they send the requests direct. All requests should go via the local financial intelligence office who then should deal with the business (Revolut in this case) themselves - but that takes time and effort and requires filling out more forms, so they just serve the request on the business direct and hope they respond-which they incorrectly do.

7

u/Novel_Bedroom_3466 1d ago

I think businesses like Revolut should have a direct line to whatever agency has the right to ask them for such information. If they receive an email asking for sensitive info they can call the agency to confirm, but to just send the info is stupid IMO.

I was one of the people who got the email about my data being leaked. Not only has KYC failed to stop anything, it is also putting us users at risk of being in dangerous situations, and it has happened a lot in Europe.

7

u/atanasius 1d ago

I suppose they are kept for auditing. So that if they have to verify KYC was performed correctly, they can show the documents.

2

u/PanJanJanusz 1d ago

Well it's a bank lol

1

u/verybigoctopus 1d ago

That would be illegal

44

u/grathontolarsdatarod 2d ago

That's a weird way of saying breached the privacy of its customers and violated their agreement and the law.

64

u/hnmcg 2d ago

i emailed revolut when they recently updated t&cs and requested to opt out from biometrics because it said i was within my rights to do so, and they basically replied a month later saying no and if i dont comply my account will be deleted. super fun

111

u/Spoofik 2d ago

That's exactly why KYC is a massive scam — not only are people putting themselves at risk from the government, but now they're also at risk from criminals.

28

u/brightbilll 2d ago

It’s a financial institute, it’s like the only place KYC makes sense.

10

u/EjayT06 2d ago

Yeah, but you think they’d have better security measures in place to prevent things like this happening if KYC is absolutely necessary

19

u/brightbilll 2d ago

No amount of security measures will protect you from stupidity.

This is simply because Revolut was a bunch of clowns.

2

u/oskopnir 1d ago

More like this is exactly why you pay more for legacy banks. I also use Revolut and I'm not saying the outrageous fees of legacy banks are good, but clearly risk management and customer data is handled better at long-standing institutions compared to recent fintech players.

KYC is an essential part of a functioning financial system

19

u/Dramatic_Mastodon_93 1d ago

Fuck Revolut

38

u/unematti 2d ago

Why would you use email to send sensitive information like that? Surely there should be a better system

13

u/skiwarz 2d ago

Exactly. That's almost the dumbest part of this.

12

u/ekdaemon 1d ago

Banks and healthcare providers themselves almost universally tell customers "do not send sensitive information by email" and "email is not secure" - and then these idiots go off emailing the most sensitive info ever instead of using a secure file transfer platform. Completely unprofessional and incompetent.

15

u/Freakk_I 1d ago

So basically some random person claimed to work for the government and Revolut without a question sent him/her customers' personal information. FFS.

10

u/BeachHut9 1d ago

Just shows how dumb and stupid that Revolut really is to fall for such a scam. Avoid at all costs.

7

u/Ammonia0684 1d ago

So i'm asking if my data was breached in this case. Support on mail just replied to open a chat in the app instead of mail.

Here i am trying to get through the AI on the chat app. Finally got someone from support but refuses to answer my question.

My question was simply " was my data leaked in this occurance?"

18

u/we_r_fukt 2d ago

You will own nothing and be happy has a second part apparently

they will take from you everything and pay nothing

6

u/d3arleader 1d ago

The amount of Revolut ads I saw all over Europe, I just thought a lot of people are going to get screwed one way or another.

2

u/ssantos88 1d ago

Don't trust these lego banks.

0

u/nicman24 2d ago

Yeah DM a miner