Who Checks the ID of Someone Asking for Your Data?

Key takeaways

• The Revolut allegation hinges on whether customer information was actually disclosed.
• Verifying customers and verifying outside data requesters are separate security tasks.
• Official-looking paperwork can trick staff into handing over information through normal business procedures.
• A requester’s identity, authority, and requested data scope each need separate checks.

A financial app asks you to prove who you are before trusting you with an account. What proof does it demand from someone claiming to represent a government agency? An allegation that Revolut disclosed customer information in response to a fake government request puts that second identity check in focus.

A fake request does not establish a data leak

Receiving a fraudulent request and handing over customer data are different events. A company might reject the request. It might pause processing when a follow-up check raises doubts.

That distinction matters when assessing the Revolut allegation. What was requested? How did the company respond? Did any customer information actually leave its control?

Until that last question is answered, the allegation should not be treated as an established disclosure. The number of affected customers and the types of information involved are subsequent questions.

The phrase identity verification also needs care. It could refer to customer identity documents allegedly being exposed, or to a failure to verify the person requesting information. Those describe different things: the possible contents of a disclosure and the possible cause.

Conflating them makes both the harm and the security failure harder to understand.

Your ID check does not authenticate their request

Customer verification asks who owns an account. Verifying an outside request asks whether someone actually represents the organization they claim to represent.

A service can be rigorous about the first and weak at the second.

Consider a hypothetical request arriving with an agency logo, a case number, and an urgent demand for a customer’s details. Everything looks official. The document tells an employee to move quickly.

If that employee trusts the formatting and sends the information, the attacker has exploited an ordinary business process. This is social engineering: manipulating someone’s judgment to get past a security check.

The logo and case number may provide clues worth checking. They do not establish who sent the document. Urgency may justify a faster response, but it supplies no evidence that the sender is legitimate.

An official-looking letter is easy to mistake for an authenticated request. The distinction becomes expensive when the attachment going back contains someone’s personal information.

Three checks before anything leaves

A sound disclosure process separates three decisions:

1. Identity: Is the requester who they claim to be? Checking only through the contact details printed on the request could mean asking an impersonator to vouch for themselves. Verification needs an independently established official contact channel.

2. Authority: Is this requester entitled to obtain this information? Confirming that someone works for a real agency does not settle whether they have authority to access a particular customer’s data. The basis for the request and its limits still need review.

3. Scope: What information should be provided? A valid request does not automatically justify sending everything in an account. Staff need to identify the relevant information and record what was disclosed, along with the basis for approval.

Urgent requests also need a process defined in advance. Someone should be responsible for additional verification, and someone should be responsible for approving disclosure. A deadline should not leave a single employee improvising every decision.

The Revolut allegation turns on what was actually disclosed and how the request was handled. The broader question belongs to every service that collects sensitive information: when someone asks for your ID documents, how carefully does the service check theirs?