Global businesses are facing a growing cybersecurity challenge as attackers increasingly exploit trusted identities and legitimate communication channels rather than relying on traditional hacking techniques, security experts say, following a recent data disclosure involving digital banking platform Revolut.
The incident came to light after Revolut provided sensitive customer information to an unauthorized third party that had sent fraudulent requests using the legitimate email domain of a government agency. According to the company, its systems were not breached. Instead, the requests originated from an unauthorized email account operating within the agency’s official domain and carried valid domain authentication credentials. Revolut fulfilled the requests believing they were genuine before later verifying them with the government agency and discovering the account was unauthorized.
The information disclosed reportedly included customers’ full names, dates of birth, occupations, addresses, email addresses, telephone numbers, copies of passports or driving licences, and facial verification images collected during identity checks.
Cybersecurity specialists say the case reflects a broader shift in the threat landscape, where criminals increasingly manipulate trust relationships rather than attempting to penetrate corporate systems directly.
“The Revolut incident is an important reminder that cybersecurity failures do not always begin with malware, a missing security patch, or stolen credentials,” said Morey Haber, Chief Security Advisor at BeyondTrust. “Sometimes, via clever social engineering, a threat actor can simply ask for information and the victim provides the details freely based on poor identity confidence verification.”
Haber said the case demonstrates a critical weakness in many organisations’ security processes, namely the assumption that communications originating from a trusted domain are automatically legitimate. According to him, the incident exposed a larger identity-security challenge because “authentication is not authorization,” meaning that proving where a message originated does not prove that the sender is entitled to request sensitive information.
He described the event as a classic “confused deputy problem”, where a trusted organisation performs a legitimate action based on instructions that ultimately prove illegitimate.
As a result, cybersecurity professionals are urging organisations that handle personal, financial and identity data to adopt stronger verification mechanisms before sharing sensitive information. Haber said “out of band request and identity verification, separation of duties, least privilege, and human approval should be mandatory before sensitive information leaves the organisation,” adding that “a simple email request alone should never be sufficient.”
The growing sophistication of such attacks is also changing how security teams assess risk. Santiago Pontiroli, Lead TRU Researcher at Acronis, said threat actors are increasingly abusing legitimate accounts and business processes rather than attempting to impersonate them.
“The key lesson is that attackers are increasingly abusing trusted identities and legitimate processes rather than trying to impersonate them,” he said. If a government account is compromised, fraudulent messages can still successfully pass widely used authentication controls including SPF, DKIM and DMARC.
However, Pontiroli stressed that passing those checks does not guarantee a request is genuine. “SPF, DKIM and DMARC can help establish that an email is authentic. They cannot establish that the request itself is legitimate.”
Instead, organisations should verify sensitive requests using information attackers cannot easily access, including independently sourced contact details, case validation procedures, historical request patterns and scrutiny of unusual urgency or scope.
The incident underscores a wider reality confronting businesses worldwide: cyber threats are evolving from technical system attacks into trust-based attacks targeting people and processes. As digital identities become central to customer verification and regulatory compliance, experts say organisations must move beyond relying solely on email authentication and continuously validate the legitimacy of every high-risk request.
Source: Khaleej Times