The Government Email Was Real. The Authority Wasn’t.

The email domain was legitimate. The institutional authority behind the request was not.

In September 2026, Revolut confirmed that customer information had been disclosed after fraudulent requests arrived from an email address hosted on a legitimate government-agency domain. Because the messages appeared to originate through authentic government infrastructure, the requests passed important technical trust checks.

But authentication of the communication channel did not establish that the person sending the request was an authorized official acting for a lawful purpose.

Authentication and authority are different relationships

Modern security systems are good at asking whether a credential, token, certificate, or domain is valid. Institutions often make a dangerous additional inference: if the credential is valid, then the requested action must also be authorized.

That inference is incorrect.

GovKM distinguishes identity, capability, institutional authority, and purpose. A communication can be technically authentic while the institutional act it requests is illegitimate.

The request inherited authority from its channel

The continuity path should have been:

Government Authority → Authorized Official → Lawful Purpose → Specific Request → Disclosure Decision → Action → Record.

Instead, the authenticated government domain appears to have substituted for much of that chain.

In GovKM terms, the break occurred between Evidence / authenticated channel and Authority / legitimate requester.

This is also an AI governance problem

The incident was not primarily caused by AI, but it is directly relevant to delegated agents.

An AI agent using an authentic service account, OAuth connector, API key, or enterprise role can create the same failure. The system may be able to prove that the agent possesses permission while remaining unable to prove who sponsored the action, for what purpose, against which records, and within what limits.

This is why GovKM treats runtime authority as more than RBAC.

Purpose must remain attached to the action

A continuity-aware disclosure workflow should preserve the identity of the sponsoring authority, the legal or institutional basis for the request, the purpose, the records in scope, the effective time window, and the resulting disclosure.

If any of those relationships cannot be established, the correct response is not to infer legitimacy from the transport layer.

The GovKM interpretation

This case demonstrates a foundational continuity principle: authentication proves that a credential or channel is valid. It does not prove that the requested action is institutionally authorized.

For both human and AI actors, trusted execution requires continuity from authority to purpose to action.

Sources

Financial Times, “Hackers demand Revolut pay $3mn ransom after data breach,” September 17, 2026. https://www.ft.com/content/d1f2c9bd-26ce-4e87-9da4-fe0238bd531d

Financial Times, “Hackers say they breached Italian state email to target Revolut ‘crypto whales’,” September 16, 2026. https://www.ft.com/content/97f3d2b7-0282-42a7-bbb7-538624441a8a