Security Breach Hits Revolut Amid Israeli 'Lean Bank' License Push
In Israel, the impact of the security breach is expected to be limited for now. Revolut has yet to begin operations in Israel, although thousands of Israelis living or having lived abroad may hold accounts with the company. Meanwhile, Revolut is seeking a “lean bank” license from the Bank of Israel.
A major incident at British fintech giant Revolut, which is preparing to enter Israel under a “lean bank” model: the company has confirmed that sensitive customer information was exposed to an unauthorized party over the weekend. The incident came after Revolut received fraudulent requests sent from a verified email domain belonging to a government authority, a company spokesperson told Reuters on Saturday.
Revolut did not say whether the breach was concentrated in a particular country, nor did it identify the government authority whose identity was spoofed. However, indications suggest the incident was not confined to a single market. According to independent crypto security researcher ZachXBT, the scam was neither random nor geographically targeted, but instead specifically aimed at high-net-worth users in an effort to gain access to their financial profiles.
Phishing attacks, in which criminals seek to obtain personal information by tricking victims into clicking a link or handing over sensitive data, are typically aimed directly at end users. In Revolut’s case, however, the sophisticated fraud exploited the company’s own compliance mechanisms. The attackers used a legitimate email address associated with an official government domain to submit fraudulent information requests. Because the domain was authentic and passed Revolut’s technical security checks, company staff complied with the requests and disclosed the information — a failure in the human verification processes used to authenticate requests from law-enforcement authorities.
Meanwhile, analyst Max Karpis debunked a rumor circulating on X, formerly Twitter, claiming that a security employee had been fired after questioning the requests. He clarified that the account behind the claim was satirical and that the rumor had no factual basis. At the same time, he wrote that the incident was a troubling reminder that sensitive information can “leave the building” without a conventional cyberattack, simply as a result of human error. The incident is particularly unusual for a company of Revolut’s scale, which now serves more than 80 million customers worldwide, operates under banking licenses in more than 30 countries, and is active in the payment systems of more than 160 countries.
In Israel, the impact of the incident is expected to be limited for now. Because Revolut has yet to begin actual business operations in Israel, the incident does not affect most Israelis, although there are likely thousands — and potentially tens of thousands — of Israelis who live or have lived abroad and hold accounts with the company. At the same time, Revolut is in the midst of a process to obtain a “lean bank” license from the Bank of Israel.
In fact, Revolut’s entry into the Israeli market is one of the key hopes of the Bank of Israel and the Finance Ministry for creating meaningful competition for the country’s major banks. Digital bank One Zero, which began operating in late 2022, has succeeded in pushing traditional banks to step up their game, but has so far failed to fundamentally alter the balance of power in the market. One Zero’s long road to establishing itself illustrates why a player with significant financial backing and an international reputation may be needed to disrupt Israel’s highly concentrated banking sector. Revolut is widely seen as such a player, but the latest incident could cast a shadow over how the Israeli public perceives the company. Beyond public opinion, the incident also raises the question of whether Israeli banking regulators will tighten information-security requirements as a prerequisite for granting Revolut its license.
In addition, in July 2025, the Israel Securities Authority granted Revolut, alongside several other companies, a “payment services license.” The license allows the company to transfer and exchange funds, offer acquiring and digital wallet services, and even pay interest on funds held in customer accounts.
