A fraudster using a fake government agency domain gained unauthorized access to sensitive Revolut customer data, exposing passports, selfies, and transaction logs.