The prefecture mailbox asked for the files

Revolut’s systems were not breached. That is the part people will misread.

Italian Interior, answering parliament this week, confirmed a certified mailbox tied to the Prefecture of Reggio Calabria had been compromised. The domain was pec.interno.it. Revolut had already told customers it answered requests that looked like they came from that channel. About 680 dossiers went out. Eight of the people were Italian. Passports, IBANs, KYC selfies, statements, crypto transaction history. The UK ICO opened a file on 15 September.

A PEC address is Italy’s legally recognised certified email. Banks treat mail from pec.interno.it the way they treat a letterhead. The attackers did not need to spoof the header. They needed the mailbox.

What “sophisticated impersonation” actually was

Months of correspondence. Not a one-shot phish. Reporting from Corriere, Il Fatto, and Euronews describes Revolut asking the other side to correct a heading, apologising for delay, then sending the files, password in a separate mail. The Postal Police have said they did not send those requests.

The bank’s public line is external impersonation, a limited set of customers, address blocked on detection. All of that can be true at once. It does not change the mechanism: legal-process intake trusted the channel and never proved the officer.

Why this is not a “Revolut got hacked” story

If you are an officer, a crypto holder, or anyone whose KYC pack is sitting at a fintech, the useful question is not whether the core banking platform was dumped. It is whether anyone who holds your identity file will ship it because the From: line is a ministry.

Certified mail, a government domain, and a police letterhead are evidence of a mailbox. They are not evidence of a human. The same failure shows up as a DSAR from a stolen counsel address, a “tax authority” PDF, a Teams chat from the chairman. Different wrapper. Same skip: no out-of-band check with a number you already owned.

If a bank, a transfer agent, or your own legal inbox just fulfilled a “urgent official request” without calling the institution on a number from your directory, treat the pack as gone until you know otherwise. Rotate the identity documents they can now replay. The mailbox was real. That was the problem.