---
title: A Government Email Phishing Scam and the ID Scan Breach Update
source_page: https://www.sardine.ai/media/fraudology/episodes/government-email-phishing-scam
canonical: https://www.sardine.ai/media/fraudology/episodes/government-email-phishing-scam
format: text/markdown
date: 2026-09-17T04:01:00.000Z
description: This week in fraud news. A government email phishing scam hit Revolut exposing customer identity and financial data, plus an ID scan breach update…
---

**Quick links:** [Human page](https://www.sardine.ai/media/fraudology/episodes/government-email-phishing-scam) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo)

---

# A Government Email Phishing Scam and the ID Scan Breach Update

**Published:** 2026-09-17T04:01:00.000Z

This week in fraud news. A government email phishing scam hit Revolut exposing customer identity and financial data, plus an ID scan breach update…

Welcome back to Fraudology.
This is a solo episode, and I’ve got two stories for you this week. I wanted to follow-up on the ID scan breach that Frank McKenna and I discussed last week. Where things stand now, whether we should still be worried, and what the driver’s license data breach means for KYC fraud prevention going forward.
And then I wanted to get into one of the biggest fraud stories this week. This one is brand new and I wanted to get it to you as soon as possible. A government email phishing scam hit Revolut using what appeared to be a legitimate .gov email domain. The request was fulfilled. Customer data was released. And it did not require a breach of Revolut at all. It required a spoofed email that looked real enough to pass.
I have been talking to my fraud threat intelligence sources about this, including someone with a background at one of the three-letter government agencies. What he told me changed how I’m thinking about this incident entirely. We are going to get into all of it.
This is a fraud news episode, and I’m going to keep it tight today. Let’s dive in.
What you’ll hear in this episode:
The ID scan data breach update. Where the 153 million driver’s license database stands now, why the FBI takedown matters, and whether we should still be treating this as an active threat.
Why the ID scan breach was so dangerous for KYC fraud and identity document fraud detection. And why most verification companies would not have caught it.
What supply chain data breach risk looks like in practice and the vendor contract language every financial institution should have in place.
The Revolut government request fraud incident explained. What data was released, what a fraudster can do with it, and why it could be used for identity theft and espionage.
Why a .gov email domain is harder to spoof than it sounds, what a CAC card is and why it matters for government email security, and what my fraud threat intelligence source actually thinks happened.
The three most likely explanations for this government email phishing scam. Including the foreign adversary fraud angle that changes the whole picture.
How to prevent government email phishing at your financial institution, email authentication tools, two factor authentication for sensitive inbox access, and training the team that handles government information requests.
Why this kind of email domain spooking fraud is going to be attempted again, and what neobank fraud prevention teams specifically need to have in place.
You should listen to this episode if you:
Work in fraud, compliance, or risk at a bank, neobank, or financial institution and want to understand what the Revolut incident actually means for your team.
Are responsible for financial institution phishing prevention and want practical recommendations you can bring back this week.
Want to understand how government impersonation fraud works and why a .gov email does not guarantee legitimacy.
Are evaluating your vendor contracts for supply chain data breach liability language and want a framework for what to include.
Work in KYC fraud prevention and want to understand why the ID scan data breach was uniquely dangerous for identity document verification.
Follow fraud news and want a practitioner's read on what actually happened with Revolut, not just the viral LinkedIn version.
### Episode notes
The ID scan data breach: Where things stand
Frank McKenna and I covered this last week. The update is that the FBI appears to have taken it down quickly. The dark web forum copies that fraud threat intelligence contacts identified did not actually contain the full database. Buying individual licenses at the reported price would have cost over 15 billion dollars, which makes the copycat listings more likely to be empty shells than actual data.
Are we safe? Yes and no. The more important lesson is the supply chain data breach angle. Your vendor contracts matter. Know who owns the breach notification responsibility. Know whether your vendor is liable for credit monitoring and remediation costs. Know what your brand reputation exposure looks like if a vendor breach surfaces your customers’ data. Get the language in writing before you need it.
The Revolut government request fraud incident
This story broke on Saturday, September 12th. I am recording this the following day. There may be updates by the time you hear this, but here is what we know.
Revolut received a request from what appeared to be a legitimate US government agency that carried valid domain authentication credentials. The request was fulfilled under the reasonable belief it was authentic. The data that was released is a complete picture of an individual that can be used for financial fraud or even espionage, which is what makes the foreign adversary fraud angle so significant.
What my fraud intelligence source told me is that a genuine .gov system breach is extremely unlikely. His read is that this was most likely a foreign adversary creating an email domain that looked legitimate to the naked eye, but contained a character substitution. It could also have been an internal government actor submitting a request without going through the proper channels, or a government employee acting as a bad actor using real credentials. This was not a mass data pull. It was a small number of very specific individuals. That was an intelligence operation, not a fraud ring.
How to prevent government email phishing at your financial institution
The team that handles government information requests is your first line of defense. The same way customer service is your first line of defense for consumer-facing fraud. They need to know that a .gov email address is not enough to authenticate a request. They need training on email domain spoofing fraud, on what urgency signals look like in a fraudulent request, and on when to escalate before fulfilling.
On the tooling side, invest in an email authenticator that reads the metadata of incoming email, not just the visible domain. Two factor authentication for any inbox that handles sensitive government requests adds another layer. And review your government information requests process end to end. If it currently relies on a human reading a .gov email address and proceeding, that process needs to change.
Why this is going to happen again
If this attack worked on Revolut, it will be attempted elsewhere. Creating a domain that looks real to the naked eye requires technical skill but not exceptional resources. The payoff is extremely valuable for both fraud and intelligence purposes. Financial institutions should treat this as a category of attack that is now established, not a one-off. Update your government request verification process, train the team that handles those requests, and get the right email authentication tooling in place before the next attempt lands in your inbox.
### Key takeaways
The ID scan data breach appears to be contained, but we should still operate as though this driver’s license data is accessible. It was accessed once and the conditions that allowed it have not changed.
Supply chain data breach risk is not theoretical. The ID scan incident is a direct example of a vendor breach exposing your customers’ data. Your contracts should define who owns breach notification, remediation, and brand reputation costs before you need to find out the hard way.
The Revolut government request fraud incident was almost certainly not a breach of the US government email system. Accessing a real .gov inbox requires a physical CAC card inserted into the device. That makes credential-based spear phishing of a .gov inbox extremely difficult.
The data released in the Revolut incident includes identity documents, facial verification images, full transaction history including Bitcoin, and is enough for more than just identity theft.
The team that handles government information requests at your institution is your first line of defense. Email authentication tooling is the most important technical control financial institutions can implement right now. Layer defenses together.
If this attack worked once, it will be attempted again.
### Final takeaway
Two stories this week, and both of them come back to the same lesson. The weakest point in your fraud defense is often not your systems. It is the process a human follows when something looks legitimate. A driver's license scan that passes every check is not automatically real. A .gov email address is not automatically from the government. The people and the processes behind those verification steps are where the gap lives, and that is where the fraudsters are going to keep going until we close it.
Both of these stories had a version that spread fast and a version that looked a little different once you dug in a little further. Fraud news is more than the headlines. It is the community behind the story. The conversation, the connections, and the real answers that come from real people. Thanks for being here, and I will see you next week.
Episode resources & links
Connect with Karisse Hendrick | LinkedIn
Host of the Fraudology Podcast
Award-Winning Cyberfraud Expert
Ecommerce Fraud Prevention Consultant
Startup Advisor, Keynote Speaker, and
Consultant to Fortune 500 merchants