The news
Revolut will pay for customers to replace their identity documents after the London-based digital bank sent the personal data of about 680 customers to hackers, its Western Europe chief executive said. In an October 7, 2026 interview with BFM TV reported by Reuters, Béatrice Cossa-Dumurgier said that if customers ever have to change their ID documents, the company will cover the associated costs.
The Revolut data breach was first disclosed in September. According to Reuters, hackers took control of an Italian government email address, belonging to the Reggio Calabria police but never used before, and Revolut sent customer data in response to their request. PYMNTS reported the attacker used the legitimate government domain in a phishing scam to request the information. Of the affected customers, 55 are in France.
The data exposed included identity documents such as passports and driver's licenses, PYMNTS reported, adding that the hackers may also have seen verification selfies, contact details, account statements and transaction histories. Revolut has said its systems and customer funds were unaffected, and that it blocked the fraudulent address and notified regulators, law enforcement and data-protection authorities.
PYMNTS reported that in mid-September a hacker threatened extortion and released sample data, though Revolut previously said it had not received a ransom demand, according to Reuters. Cossa-Dumurgier told BFM TV that Revolut would not pay ransoms. Italy's interior minister, Matteo Piantedosi, said Revolut could and should have verified the request with minimal due diligence, according to Reuters. A Revolut spokesperson declined to comment on his remarks; Cossa-Dumurgier said government agencies are sometimes the weak link.
The incident lands alongside new data on how much fraud costs digital banks. A PYMNTS Intelligence report published October 7 found average fraud-prevention spending at neobanks, digital-only banks and fintechs rose 357%, from $1.8 million to $8 million per institution. Average fraud losses rose more than 250%, from $800,000 to $2.84 million, even as the fraud-loss rate fell 20%, from 0.90 to 0.72 basis points.
The numbers
- Revolut customers affected
- About 680
- Affected customers in France
- 55
- Neobank fraud-prevention spend per institution
- $1.8M to $8M (+357%)
- Average fraud losses
- $800,000 to $2.84M
- Fraud-loss rate
- 0.90 to 0.72 basis points
- Scams' share of fraud dollars, 2026
- 22.4% (from 12%)
Why CEOs should care
For CISOs and operations chiefs at banks and fintechs, the Revolut case is a reminder that the weak point was a process, not a system. A staff member released records in response to a request that appeared to come from a real government domain. Ask how your team verifies law-enforcement and regulator data requests: is there a call-back to a known number, a second approver, and a cap on how much data one request can release?
For CFOs, the PYMNTS numbers show fraud has moved from a rounding error to a budget line. Spending on prevention rose about fourfold and losses more than tripled, even while the loss rate per dollar fell, which implies faster volume growth. Replacing identity documents, notifying regulators and handling extortion attempts add remediation costs on top. Build these into unit economics rather than treating them as one-off.
For boards and product leaders, trust is the revenue risk. PYMNTS Intelligence found 28% of consumers whose households suffered scam losses cut back or stopped using neobank accounts. Ask management how quickly affected customers are told, what the company pays for, and how churn after incidents is tracked.
The bigger picture
Fraud is shifting toward attacks that look legitimate. PYMNTS Intelligence found customer manipulation scams made up 22.4% of fraud dollars in 2026, up from 12%, and account takeover via compromised credentials 28.2%; over half of fraud dollars now involve legitimate logins or customer manipulation. Every surveyed institution uses behavioral analytics and device fingerprinting, and 96% use machine learning, yet losses still climbed. The Revolut incident applies the same pattern to the bank itself: the attacker borrowed a trusted identity rather than breaking in.
What’s next
Watch whether European data-protection authorities open formal action against Revolut and whether other banks tighten how they answer government data requests. Further PYMNTS Intelligence and industry data will show whether rising prevention budgets begin to bend fraud losses down.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
