When legitimate email isn’t enough: the Revolut case raises questions about the future of digital identity

A recent security incident involving Revolut raises a question that goes far beyond one company or one financial institution: how can we reliably verify in the digital world not only where a request for sensitive data comes from, but also who is actually sending it, whether that person is authorized to make the request, and which data they are entitled to access? The case shows that a communication channel can appear legitimate without necessarily proving the identity and authority of the person on the other side.

What happened?

In September 2026, Revolut confirmed a security incident in which an unauthorized third party used an email address on the legitimate domain of a government authority to send fraudulent requests for customer information.

According to Revolut, the incident involved external impersonation. Once the misuse was discovered, the company blocked the address and notified the relevant government authority, law enforcement agencies and regulators. Revolut also emphasized that its systems and customer funds were not affected.

However, sensitive information belonging to a limited number of customers was disclosed to an unauthorized party. According to publicly available information, the data may have included personal and contact information, copies of identification documents and, for some customers, other information related to accounts and transactions.

This is an important distinction.

We are not talking about a confirmed breach of Revolut’s core systems, but about a different type of security problem: the request arrived through a communication channel that appeared legitimate, while the person behind it was not authorized to receive the requested information.

The real question is not only: “Where did the message come from?”

Digital communication has long relied on the verification of domains, certificates, accounts, devices and other technical elements.

But the legitimacy of a communication channel alone does not answer three crucial questions:

Who is requesting the data?

Is that person authorized to request it?

Which data is that person actually entitled to receive?

This is where the Revolut case has broader significance.

If someone communicates through a legitimate system or from a legitimate domain, this does not necessarily mean that they also have legitimate authority to perform a specific action.

“In the digital world of the future, it will not be enough to verify where a request comes from. We will also need to verify who is sending it, under what authority, and which data they are entitled to access.”
— Institute 1. april

Digital identity is not a financial service

In this context, it is important to distinguish between two different things.

Revolut is primarily a financial platform and provider of financial services. Digital identity, on the other hand, is infrastructure for proving the identity, attributes, authorizations or rights of an individual or organization.

They are not the same thing.

A financial service may manage:

bank accounts and payments,

cards and money transfers,

financial transactions,

personal finances.

A digital identity system, however, can be used to prove:

who a person is,

what role they have,

whether they hold a specific authorization,

whether they are entitled to access a particular service or piece of data.

One manages finances. The other proves who you are or what you are authorized to do.

What should a system of the future verify?

Imagine that a government authority needs certain information from a financial institution.

Today’s process may involve official communication, an institutional email address, documentation and internal verification procedures.

A more advanced digital identity system could require additional cryptographic proof:

IDENTITY VERIFIED

ORGANIZATION VERIFIED

ROLE VERIFIED

AUTHORITY VERIFIED

REQUEST SCOPE VERIFIED

Only then:

DATA ACCESS AUTHORIZED

This means that the system would not verify only whether a request comes from a particular institution.

It would also verify whether the specific person is actually authorized to make that specific request.

And this is where the QEI question begins

At Institute 1. april, as part of the development concept QEI – Quantized Encrypted Identity, we are exploring precisely how the digital identity of the future could enable stronger cryptographic verification while simultaneously reducing unnecessary disclosure of personal data.

At this stage, QEI is not an implemented system, and we therefore do not claim that it would have prevented the specific Revolut incident.

However, the case provides a useful starting point for a research question:

Could future digital identity infrastructure verify not only a person’s identity, but also their current role, authorization and the permitted scope of a specific request?

For example:

WHO ARE YOU?
→ verified digital identity

WHO DO YOU REPRESENT?
→ verified connection to an institution

WHAT IS YOUR ROLE?
→ verified role

ARE YOU AUTHORIZED?
→ cryptographically verified authorization

WHAT MAY YOU ACCESS?
→ permitted scope of data

Only then would the system decide whether access should be granted.

Not “trust the domain,” but “verify the authorization”

This would represent an important shift in digital security.

Instead of:

“The message comes from an official domain, therefore we trust it.”

the system could apply the principle:

“The channel has been verified. Now verify the person, their role, their authorization and the scope of the request.”

Even a compromised or misused communication channel would therefore not, by itself, provide sufficient proof for access to sensitive information.

Disclose only what is necessary

Another important element is the amount of data involved.

When responding to a request for information, the question should not only be whether access is authorized, but also:

which data is the person authorized to access?

If an official has lawful authorization to obtain one specific piece of information, this does not necessarily mean that they need access to the individual’s entire profile.

This relates to one of the central principles behind QEI:

prove the necessary attribute or provide the necessary access with the minimum possible disclosure of data.

Instead of:

AUTHORIZED = ACCESS TO EVERYTHING

the principle could be:

AUTHORIZED FOR PURPOSE X = ACCESS ONLY TO DATA REQUIRED FOR PURPOSE X

Such an approach is connected to the principles of data minimization, purpose limitation and Privacy by Design.

But QEI must not become a new central point of surveillance

There is also an important warning.

If a digital identity system verifies identity, institution, role and authorization, poorly designed infrastructure could also become a very powerful system of centralized surveillance.

The question is therefore not only:

How can we increase verification?

Equally important is:

How can we increase verification without increasing unnecessary surveillance of the individual?

This is why the development of such an architecture must include cryptographic protection, minimum disclosure of data, clear separation of authorizations, traceability of access and independent security and legal assessment.

The Revolut case is a warning for the entire digital ecosystem

The case is therefore not relevant only to one financial company.

A similar issue can arise wherever organizations process sensitive information and receive requests from other institutions:

banks, insurance companies, telecommunications providers, healthcare institutions, government registries, digital service providers and many other systems.

Digitalization increases the speed at which data can be exchanged.

But faster data exchange must also be accompanied by stronger verification of who is entitled to receive that data.

“A verified communication path is not yet a verified identity of the sender. A verified identity is not yet a verified authorization. The digital trust of the future will need to prove all three.”
— Institute 1. april

From identity to verifiable authorization

The Revolut case demonstrates why the next generation of digital identity should not answer only the question:

“Who are you?”

It should also answer:

“Who do you represent?”

“What is your role?”

“What are you authorized to request?”

“Which data are you entitled to receive?”

And perhaps most importantly:

“Is your authorization valid right now, for this specific request?”

This is an area we want to explore in greater detail as part of the research and development of QEI.

Not in order to replace existing European or national digital identity systems.

Rather, to explore whether the digital trust of the future can be built in a way that allows the system to verify more about the authorization to perform an action while revealing less about the individual.

Note: QEI – Quantized Encrypted Identity is a development and research concept of Institute 1. april. QEI is currently not an implemented or certified system. The Revolut case is used in this article as a starting point for a research discussion on the verification of digital identity, roles and authorizations; the article does not claim that QEI would have prevented this specific incident.