01The scenario: an administrative Trojan horse
The illustration shows a Trojan horse pushed by hooded figures up to Revolut's entrance. On its side, a banner: “Government Request”. The email authentication checks — SPF, DKIM, DMARC — are all ticked in green, labelled “apparently legitimate”. Security guards watch the request go through; behind the gate appears the data the operation is after.
- KYC documents;
- identity data;
- transaction histories;
- account details.
Trust can be a vulnerability.Philippe Henry, “Revolut: when trust becomes a vulnerability”, September 2026
02What the illustration highlights
SPF, DKIM and DMARC checks verify that a message really comes from the domain it claims. They say nothing about the legitimacy of the sender, nor about the reality of the procedure invoked. A fraudulent legal request sent from a compromised official address, or a skilful imitation, therefore gets through the technical barriers.
The risk is all the higher because such requests play on authority and urgency, and because teams are trained to cooperate with the authorities. For a financial institution, the data at stake (KYC, identity, transactions) is among the most sensitive it holds.
03Reflexes to put in place
- Verify out of bandConfirm any request from an authority through a known channel independent of the message received, never through the contact details it provides.
- Formalise the circuitCentralise the handling of legal requests in a dedicated team, with a written procedure and dual approval.
- Limit the scopeOnly disclose the data strictly covered by a request whose legal basis has been verified.
- Train and testRaise team awareness of social engineering based on authority and urgency, including through exercises.
These good practices reflect OpenbanQ's reading; the original illustration is available as a PDF.
Sources : Philippe Henry, “Revolut: when trust becomes a vulnerability”, September 2026 (illustration); OpenbanQ reading.