# The prefecture mailbox asked for the files

2026-09-20

Revolut handed over dossiers on about 680 customers after months of requests from a real Italian government PEC address. The mailbox was genuine. The people behind it were not.

Canonical: https://www.fabiocti.com/notes/the-prefecture-mailbox-asked-for-the-files/
Author: Fabio Correia

Revolut’s systems were not breached. That is the part people will misread.

Italian Interior, answering parliament this week, confirmed a certified mailbox tied to the Prefecture of Reggio Calabria had been compromised. The domain was `pec.interno.it`. Revolut had already told customers it answered requests that looked like they came from that channel. About 680 dossiers went out. Eight of the people were Italian. Passports, IBANs, KYC selfies, statements, crypto transaction history. The UK ICO opened a file on 15 September.

A PEC address is Italy’s legally recognised certified email. Banks treat mail from `pec.interno.it` the way they treat a letterhead. The attackers did not need to spoof the header. They needed the mailbox.

## What “sophisticated impersonation” actually was

Months of correspondence. Not a one-shot phish. Reporting from *Corriere*, *Il Fatto*, and Euronews describes Revolut asking the other side to correct a heading, apologising for delay, then sending the files, password in a separate mail. The Postal Police have said they did not send those requests.

The bank’s public line is external impersonation, a limited set of customers, address blocked on detection. All of that can be true at once. It does not change the mechanism: legal-process intake trusted the *channel* and never proved the *officer*.

## Why this is not a “Revolut got hacked” story

If you are an officer, a crypto holder, or anyone whose KYC pack is sitting at a fintech, the useful question is not whether the core banking platform was dumped. It is whether anyone who holds your identity file will ship it because the From: line is a ministry.

Certified mail, a government domain, and a police letterhead are evidence of a mailbox. They are not evidence of a human. The same failure shows up as a DSAR from a stolen counsel address, a “tax authority” PDF, a Teams chat from the chairman. Different wrapper. Same skip: no out-of-band check with a number you already owned.

If a bank, a transfer agent, or your own legal inbox just fulfilled a “urgent official request” without calling the institution on a number from *your* directory, treat the pack as gone until you know otherwise. Rotate the identity documents they can now replay. The mailbox was real. That was the problem.