Hackers did not have to break into Revolut to obtain sensitive customer information. And banks did not have to suffer their own technology failures for an outage at the Fed’s National Information Center (NIC) to disrupt infrastructure used to monitor the financial system. Instead, the soft spots appeared inside the trusted institutional machinery surrounding financial institutions.
Revolut first confirmed Friday (Sept. 11) that it was fooled by a fake emergency data request coming from a real, but compromised, government-agency email from Italy’s PEC certified-email system, Reuters reported Saturday (Sept. 12). Attackers exchanged messages with Revolut over several months while impersonating law enforcement, resulting in the FinTech sharing sensitive client information that potentially includes identity documents, verification selfies, addresses, account statements and transaction histories, including cryptocurrency activity.
Revolut is now reportedly being extorted by the hackers behind the compromise.
Reached by PYMNTS, a Revolut spokesperson said Wednesday (Sept. 16): “Revolut recently identified a sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information. Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection and financial regulators. Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support.”
Meanwhile, the Fed’s NIC, a repository that regulators use to collect and share information about financial institutions, suffered an August outage that disrupted internal systems and data pipelines across several Fed business areas, including systems serving the discount window, The Wall Street Journal reported Tuesday (Sept. 15).
The incidents are unrelated, and their severity is different. But together they expose an emerging operational problem for financial institutions. Banks have spent years strengthening their own defenses and scrutinizing their vendors. The next risk perimeter may include the institutions banks are required to trust, something harder to control.
Read also: How 153 Million Stolen IDs Could Supercharge 5 Enterprise Fraud Attacks
Banks Secured Their Perimeters, but the Risk Is Moving Outside
Financial institutions spent $21 billion in 2025 solving identity problems, according to Juniper Research, which estimated $39 billion would be spent in 2030.
Know your customer (KYC) systems ask whether a customer really is who they claim to be. Know your business (KYB) programs attempt to establish the legitimacy and ownership of corporate customers. Authentication technologies continuously determine whether someone accessing an account possesses the appropriate credentials.
The PYMNTS Intelligence report “Payment Protection: Why Firms Still Aren’t Real-Time Ready” found in August that 65% of firms plan to adopt or expand identity verification and KYC automation within the next 12 months, putting it ahead of secure bank connectivity and artificial intelligence-based fraud detection, both at 59%. Only reconciliation automation, at 70%, drew more near-term interest.
Separate data from the PYMNTS Intelligence report “When ‘Good Enough’ Isn’t Enough: Digital Identity Verification in the Age of Bots and Agents” revealed in January that financial services firms lose nearly $34 billion in revenue because of identity verification failures.
However, government requests turn the equation around. A bank can establish that a message came through legitimate government infrastructure without necessarily establishing that the individual using it possesses legitimate authority to request a specific customer’s data.
See also: The New Cyber Math for CFOs: One Attack, Hundreds of Disclosures
That problem is particularly consequential for financial institutions because banks possess unusually complete collections of identity information. The very controls designed to prevent financial crime can produce unusually valuable targets for it. KYC and anti-money laundering rules require institutions to know their customers. The consequence is that banks may hold passports, driver’s licenses, addresses, verification photographs and detailed financial histories in the same environment.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
That changes where fake government and emergency data requests belong on a bank’s risk map. They are not simply phishing attacks. They exploit institutional trust.
“In the life cycle of a fraud or a scam, most of those fraudulent scenarios are happening outside of the banking system,” Colin Parsons, head of fraud product strategy at Nasdaq Verafin, told PYMNTS in an interview published Sept. 3. “The challenge really is that it only becomes visible to an institution at the time a transaction’s occurring, or money’s moving.”
Read also: AI Gives Cybersecurity a Backlog CFOs and CISOs Can’t Patch Away
Operational Risk Is Escaping the Bank
The Fed’s NIC outage presents almost the opposite scenario. Instead of an attacker abusing trust in government infrastructure, the government infrastructure itself became unavailable.
Banks have sophisticated answers for commercial dependencies. They can negotiate service-level agreements. They can demand cybersecurity certifications. They can maintain backup processors, diversify cloud workloads and build contingency plans around core providers.
Government infrastructure is different. A financial institution cannot simply switch regulators because one system experiences downtime. Nor can it dictate the technical architecture of a law enforcement communications platform through which it receives lawful information requests.
The NIC supports the collection and sharing of public and confidential information about financial institutions among regulators. The August outage affected its public-facing system but also disrupted internal systems and data pipelines. Critical functions remained operational, the Fed said, per The Wall Street Journal report. The cause has not been publicly established.
Financial institutions can have functioning servers, functioning security controls and functioning employees and still experience consequences because something outside their perimeter failed or because an outside institution they legitimately trusted was successfully impersonated.
The PYMNTS Intelligence report “2025 State of Fraud and Financial Crime in the United States” found in December that 68% of financial institutions increased their fraud detection budgets year over year. That spending came as 46% of institutions reported sophisticated fraud schemes, up from 35% a year earlier.
The financial industry’s next perimeter may not be a perimeter at all.
For all PYMNTS B2B coverage, subscribe to the daily B2B newsletter.
Add as Preferred Source
