La grande truffa alla banca Revolut. Lo stato delle vaccinazioni infantili in Europa

A group of hackers managed to convince the British digital bank Revolut to hand over the personal and financial data of at least 680 clients by posing as Italian regulators, using a compromised certified email (PEC) box belonging to the Reggio Calabria Prefecture. The attack did not involve breaking into Revolut’s systems—it exploited the bank’s trust in what appeared to be official requests from law enforcement. This episode of Il Mondo examines the mechanics of the fraud, the responsibilities it reveals, and then shifts to a separate but equally pressing issue: the decline in childhood vaccination coverage across Europe and the risk of a resurgence of infectious diseases.

How the Revolut Fraud Worked

The attackers used a technique sometimes called "spray and pray." They gained access to a legitimate PEC box of the Reggio Calabria Prefecture—likely by purchasing stolen credentials online, possibly obtained through an "infostealer" malware. From that compromised institutional address, they sent a series of requests to Revolut, signed by the Postal Police, with correct references to the Privacy Code and formatted to resemble European Investigation Orders. The only element missing was the judge’s decree that normally accompanies such requests. Despite this, Revolut’s staff was convinced they were dealing with an institutional interlocutor.