Attackers who exploited a fake government request to access Revolut customer records have made their first move.