Revolut Just Proved KYC Is DANGEROUS

So before we dig into the details of this crazy story, we have to ask a simple question.

What is a lawful request desk? Every regulated financial institution in Europe has one.

It's the team that receives orders from police, prosecutors, and tax authorities, verifies them, and hands over customer data.

And the entire thing is engineered around one instruction, which is to say yes to the state, quickly, without tipping off the customer.

Now, consider what that means in practice.

If you run a desk and you stall a European investigation order from a national prefecture, you are the problem.

Your regulator will treat hesitation as obstruction.

Speed is the product, and that is the vulnerability.

So here's how it was exploited.

An attacker got into an Italian government's mailbox on the country's PEC system.

That's Posta Elettronica Certificata, Italy's legally recognized certified email network, apparently via an infosealer infection on a government employee's machine.

One of the addresses reported sits on the Interior Ministry's domain.

So, every email sent from it passed the usual security checks, making it look legitimate.

In other words, every single technical check a security team actually looks at came back clean because the mail was genuine.

The requests were presented as European investigation orders and aimed at Revolut Bank UAB, the Lithuanian licensed entity that holds EU customer data.

And the worst part? Well, when the attacker's paperwork was formatted wrong, Revolut's staff at times coached him on how to fix it, rather than picking up a phone to the issuing agency.

Yikes.

So then, what did that actually get him? Well, this is where we address the all-important KYC files, and the concept of KYC itself.

When opening their accounts, Revolut users photographed their passport or their driver's license.

They held their face up to their phone camera for a liveliness check.

They typed in their home address, their date of birth, their occupation.

Standard enough.

But then the platform built the second half of the file without asking them for anything, because it's required to.

Every deposit, every conversion, every withdrawal, their IBAN, their statements, their account opening date, and, in this case, complete Bitcoin transaction histories.

Individually, each piece may not be a huge deal.