Passports, selfies and financial transaction histories of some customers were revealed to a fraudster using a government agency domain.