At 9:59PM on the night of September 11, an email landed in the inboxes of some of Revolut's wealthiest customers. It came from Revolut, it was genuine, and it carried the worst kind of news a bank can deliver. Your data is gone, it said, and we are the ones who gave it away.

Days earlier, someone had emailed Revolut from an address on a real government agency's domain and asked for customer information. The message looked like the kind of official demand a bank fields all the time. It passed every automated check an email can pass. Revolut read it as a legitimate government request and handed over the files.

The Email That Passed Every Test

Email carries three standard defenses that check whether a message really came from the domain it claims: SPF, DKIM, and DMARC. You do not need to know how they work. You need to know what they prove, which is only that the email truly came from that domain, not that the person who sent it had any right to send it. The attacker was not spoofing a government address from the outside. The attacker was sending from inside a real government mailbox, or one close enough, so all three checks came back green. The technology did its job perfectly and told Revolut a lie.

From there it was a judgment call, and the judgment failed. Banks receive government and law enforcement demands constantly, and there is heavy pressure to answer them quickly, especially when a request claims urgency. Revolut treated the message as a real legal request and released the dossier. In its own words:

The crypto investigator known as ZachXBT, who tracks this kind of theft for a living, looked at who got hit and concluded the operation was aimed at high net worth users. That is not an accident of the data. That is a shopping list. Among the names surfacing in the leaks were the tennis player Alexander Shevchenko and Felix Roemer, chief executive of the gaming firms Gamdom and Skinscom.

The Power of Subpoena

Move from London to your own country, because this is not a Revolut problem and it is not a European one. It is the design of the system you already live inside.

In the United States, a company that holds your data generally cannot give it to the government without legal process. A prosecutor or a grand jury issues a subpoena. A judge signs a court order or a warrant after someone shows cause. Each of those leaves a record and passes in front of a person whose job is to say no. That is the front door, and it is guarded.

There is also a side door. A federal law, 18 U.S.C. 2702(b)(8), lets a company voluntarily hand over your data with no subpoena, no warrant, and no judge, as long as it believes in good faith that someone faces a danger of death or serious physical injury. The exception exists for real emergencies, a kidnapping in progress or a caller threatening suicide, the cases where waiting for a judge could get someone killed. A request through that door is called an emergency data request, an EDR, and it needs no seal, no signature, and no court. It needs an email and a story.

The volume is the reason nobody has time to check. Verizon alone reported more than 36,000 emergency requests in a single six-month period and complied with roughly 90% of them. Across the industry, emergency requests run between 5 and 30% of all law enforcement demands. The people answering them are triaging a flood.

Criminals worked out years ago that the side door has no lock. In 2021, a crew of mostly teenagers operating as Lapsus$ used compromised police email accounts to send forged emergency requests to Apple, Meta, and Discord, and the companies handed over user data. When Bloomberg and the reporter Brian Krebs exposed the wave in March of 2022, Krebs described what the criminals had really acquired. They had gained, he wrote, "the power of subpoena." It did not stay a data problem. In October of 2023, a man sent Verizon a fake emergency request from a ProtonMail address, received a woman's home address and call logs, and showed up at her house armed. By November of 2024 the FBI issued a public advisory warning that criminals were selling stolen government email credentials on crime forums, with sellers claiming access to police accounts in more than two dozen countries.

The market matured the way every criminal market does. Today a working fake emergency request runs $1,000 to $3,000 through people who will send it for you, an instruction kit sells for about $100, and a verified police email account goes for around $1,000, with some sellers advertising turnaround under an hour. This is where careful habits stop mattering, and I mean that as a warning, not an insult. You can use a different password everywhere, freeze your credit, and refuse every phishing email for the rest of your life, and none of it touches this. Somewhere out there is a magistrate's email login for a county you have never visited, one of roughly 18,000 law enforcement jurisdictions in this country, and the company holding your data has no real way to know whether a request from that account is a judge in South Texas or a teenager in another hemisphere who bought the password for a thousand dollars. Your bank answers to a badge it cannot inspect.

The Second Wave

The theft was the first fraud. The second one started the moment the news broke, and it will take more money from more people than the breach itself.

Within a day of the leak, the thieves began posting customer files on X and Telegram, with a message aimed squarely at the company:

That is extortion pointed at Revolut, and the customers are the leverage. Their names, faces, and balances are the currency being spent.

Then come the saviors. After every large breach, a second layer of criminals arrives wearing the mask of help. They email the victims. They buy search ads. They stand up websites carrying the real company's logo, colors, and login box, sometimes a near-perfect clone of the Revolut site, and they promise to secure your account, reverse the fraud, or recover funds you have not even lost yet. A frightened person who just learned that their passport and crypto history are sitting on Telegram is exactly the person who clicks. The recovery scam is one of the oldest plays in the business, and a fresh breach is its harvest season.

What makes this one crueler is the channel. Revolut is doing the responsible thing and notifying victims directly, by email, telling them what happened and warning them to watch for phishing. The scammers are sending email that looks the same, from addresses that look close enough, about the same breach, offering the same help. The true notice and the fake notice arrive in one inbox, on one day, about one event, and both tell you to act now. Revolut cannot fix that, because it does not own your inbox, and the criminals understand something the rest of us would rather not: the single moment you are most willing to believe an email from your bank is the moment your bank actually needs to email you.

Field Manual

The first four are for anyone whose data sits with a company that could be fooled, which is everyone. The last two are for the exposed, and for the people who answer these requests for a living.