Revolut handed over KYC docs, selfies, and BTC transaction histories after a fake gov email with valid domain credentials passed its checks.