Revolut handed customer passports, verification selfies, IBANs and Bitcoin transaction records to scammers who used a legitimate government agency email domain.