When a user opens the Revolut app on a new device, the authentication flow changes. Instead of a standard password entry, Revolut relies on phone number-based authentication paired with device recognition and multi-factor verification. The app’s security architecture learns which devices are trusted, and it challenges unfamiliar access attempts with additional verification steps. Understanding when and why these notifications appear—and how to manage them—is essential for users who travel, upgrade phones, or access their accounts from multiple locations.

The practical question for most users is straightforward: why does Revolut sometimes require extra verification, and how can they safely add a new device to their trusted list? A Revolut login on a phone that the system has never seen before will trigger a different authentication path than logging in on an established device. This is not a random inconvenience. It is a deliberate security control designed to prevent unauthorized access while remaining usable for legitimate account holders. The mechanism relies on device binding—a persistent association between the app, the phone’s hardware, and Revolut’s security backend.

How device binding works in the Revolut app

Device binding is the process by which Revolut’s servers associate a unique identifier—derived from the phone’s hardware characteristics, the app installation, and encrypted local state—with a specific user account. On first use, the Revolut app generates this identifier locally and registers it during the initial authentication. Subsequent logins on the same device can then proceed faster because the system recognizes the hardware and does not need to repeat the full verification sequence every time. This recognition is persistent: it survives app reinstalls if the device’s hardware remains unchanged, and it can survive phone OS updates as long as the underlying device identity does not shift.

The binding process does not require manual configuration by the user. It happens automatically when the Revolut app authenticates successfully on a device. The app uses the phone’s secure enclave or trusted execution environment—Apple’s Secure Enclave on iOS and Google’s StrongBox on Android—to store cryptographic material that makes the binding resistant to theft or cloning. A copied app on a different device will not inherit this binding because the hardware identifiers differ.

From the user’s perspective, this means the first Revolut login after installation always involves slightly more friction. The app cannot immediately assume it is the legitimate owner, so it requests SMS code verification sent to the phone number on file. If biometric authentication is enabled, the system may also request Face ID or fingerprint. Only after these steps confirm the user’s identity does the device become part of the trusted list, and the next login on the same hardware can rely on faster verification.

When a Revolut new device login triggers additional verification

A Revolut new device login occurs whenever the system detects that the authentication request is coming from hardware it has not previously associated with the account. This can happen in several scenarios: the user has purchased a new phone, performed a factory reset, switched to a different device, or installed the Revolut app on a tablet or spare phone for the first time. The app and Revolut’s backend will treat this as an untrusted access attempt until the identity is re-verified.

The verification challenge typically includes a request for the SMS code, which Revolut sends to the registered phone number. This adds a critical layer: an attacker who has obtained the login credentials or phone number would still need access to the actual SIM card or the number’s SMS messages to proceed. If the user has registered an authenticator app or backup codes during setup, Revolut may also accept those as second factors. The system’s goal is to confirm that the person initiating the Revolut new device login is the account holder or someone they have authorized.

The notification that appears during this process—often phrased as “New login detected” or “Verify your device”—serves two purposes. First, it alerts the user to the attempt so they can review whether they initiated it. Second, it gives them the option to approve or deny the access. If a user receives a notification about a Revolut login attempt from a device they do not recognize, they can reject it immediately without entering any codes, which will prevent the unauthorized login from completing.

Time-sensitive confirmations also matter. Revolut typically allows a narrow window for responding to a verification challenge—often 10 to 15 minutes—before the request expires and the login attempt must be restarted. This reduces the window for an attacker trying to complete an unauthorized login while the legitimate user is away or asleep. It also encourages users to respond promptly if they have genuinely initiated a new login, reinforcing the security habit of staying alert to authentication events.

Biometric and SMS verification in combination

The Revolut app’s login flow typically combines two independent verification methods: something you know (the SMS code), something you are (biometric data), and something you have (the phone with the SIM). This layering is more effective than any single method alone. An attacker who has stolen the password or guessed the phone number still cannot complete the login without the SMS code. Even if they have compromised the SIM or intercepted SMS messages, they would still need to unlock the phone with the correct biometric—which is not transmitted to Revolut and cannot be copied over the network.

Biometric authentication on iOS and Android is managed by the operating system’s secure hardware. When a user enables Face ID or fingerprint for the Revolut app, the app itself never receives the biometric data. Instead, the OS confirms to the app that the user has successfully unlocked the device, and the app can proceed. This design means Revolut cannot be phished or tricked into accepting false biometric data; the phone itself is the authority on whether the person holding it is the registered user.

The SMS code remains a separate verification channel, and it arrives independently via the mobile network. This redundancy is intentional. If a user’s phone is turned off but their SIM is in an attacker’s cloned device, the SMS will not arrive. If the SIM has been swapped by a social engineer, the attacker might receive the SMS but would still lack the phone’s biometric capability. The combination of both factors means neither weakness alone can compromise the account.

For users in high-security situations—such as those managing large account balances or traveling in areas with weak mobile networks—understanding this layering helps explain why the Revolut app sometimes requires multiple steps rather than a single verification method. Each step protects against a different threat model, and together they create a defense-in-depth posture that deters casual attackers and makes sophisticated attacks substantially more difficult.

Managing trusted devices and revoking access

The Revolut app provides options to view, rename, and remove devices from the trusted list. Users can access this through the security or account settings, where a list of recognized devices is usually displayed with the device name, model, approximate last-login date, and location information (if geolocation services are enabled). This list is valuable: it allows a user to spot suspicious access and take action quickly.

Removing a device from the trusted list forces that device to go through full verification the next time it attempts a Revolut login. This is an important safeguard if a phone is lost, stolen, or sold to someone else. Revoking the device means the previous owner’s app cannot log in again without the SMS code and biometric verification, even if they have memorized the password or kept it written down. The revocation takes effect immediately, though there may be a brief delay before the backend update propagates.

Users should also be aware that trusting a device is not the same as trusting the person holding it. If a phone is unlocked and left unattended, someone else can open the Revolut app and initiate transactions without re-authenticating, because the app session persists on trusted devices. Enabling automatic session timeout—which Revolut offers as a configurable setting—can reduce this risk by forcing re-authentication after a period of inactivity. A timeout of 5 to 15 minutes is common and balances security with usability.

Another important practice is to review the list of trusted devices periodically, particularly after traveling, using public WiFi, or encountering phishing attempts. If a device listed does not belong to the user, or if a location does not match the user’s known movements, it may indicate unauthorized access or a compromised account. Removing unknown devices and changing the account password are appropriate responses in such cases.

Revolut login across regions and regulatory variations

Revolut operates through region-specific licensed entities, and the login experience may vary slightly depending on the user’s location and regulatory requirements. Users in the UK access Revolut through Revolut Ltd, while EU customers use Revolut Bank UAB. These entities have different regulatory obligations regarding authentication, fraud prevention, and data retention. The core device binding mechanism is consistent, but additional verification steps may be triggered by regional requirements or risk assessments that vary by jurisdiction.

For users who travel internationally or maintain accounts in multiple Revolut entities, logging in from an unfamiliar location may trigger enhanced verification. Revolut’s fraud detection systems monitor for unusual access patterns, such as logins from countries far apart within an implausibly short time, or access from IP addresses in high-risk regions. These location-based checks operate in parallel with device binding. Even if a device is trusted, a location inconsistent with the user’s historical pattern can prompt an additional verification request.

This is why users who travel frequently or change time zones should expect occasional additional verification prompts. They are not signs of account compromise; they are signs that Revolut’s systems have detected a change in access pattern and are applying an appropriate security response. Approving the login through SMS and biometric verification confirms that the access is legitimate and helps the system learn the user’s travel patterns for future reference.

Recovery and security when locked out

If a user is unable to complete a Revolut login—because the phone is lost, the SIM card has been swapped, or the registered number is no longer accessible—account recovery is still possible, though it is slower than routine access. Users can contact Revolut support and go through a manual identity verification process. This typically involves confirming personal details, account history, recent transactions, and sometimes providing government-issued identification.

The recovery process is intentionally thorough because it bypasses the normal device and SMS verification. An attacker who has stolen the account details but not the phone would need to convince support that they are the legitimate owner, which is much harder when the current owner can contest the claim. For this reason, keeping contact information current and account recovery options up-to-date is a critical security habit. If an email address changes, a backup phone number is added, or an authenticator app is set up, the user should update these details in Revolut immediately.

Another recovery safeguard is the backup codes that Revolut offers during setup. These are one-time passwords that can be used instead of SMS in emergency situations. A user should save them securely—ideally on paper stored offline—and treat them with the same care as a recovery phrase for a cryptocurrency wallet. If the SIM is swapped or SMS is intercepted, a backup code can still complete the verification and regain account access.

Best practices for secure Revolut app usage

Secure Revolut app usage starts with a strong, unique PIN that is difficult to guess and never shared. The PIN is the first line of defense when the phone is physically accessed, and it is typically required before sensitive actions like enabling new devices or changing security settings. A six-digit PIN is standard, but users can often set longer ones for additional strength.

Biometric authentication is recommended because it is faster and more resistant to observation than typing a code. Face ID and fingerprint do not transmit the actual biometric to Revolut; the phone verifies the match locally and confirms only the result to the app. This design makes biometric verification harder to intercept or forge than a code sent over the network, though the phone itself must remain physically secure.

Using Revolut on public WiFi is generally safe because the app uses encrypted connections and does not rely on network security. However, users should avoid public WiFi networks that require web-based login portals or that display suspicious security warnings. The app’s encryption is designed to protect against network eavesdropping, but it does not protect against malware installed on the device itself.

Finally, users should treat their registered phone number as a critical security asset. Never provide it to untrusted sources, and do not change it without immediately updating the information in the Revolut app. A social engineer who can convince a mobile carrier to switch the number to a new SIM can intercept SMS codes and gain account access. This attack vector, known as SIM swapping, is rare but serious. Users who are targets of persistent phishing or who manage high-value accounts may want to contact their mobile carrier and request additional security measures, such as a PIN requirement before SIM changes or a whitelist of authorized devices.

Troubleshooting common Revolut login issues

If a user receives a Revolut login notification for an access they did not initiate, the correct response is to deny the request immediately through the notification. This will block the unauthorized login. If the notifications continue, it may indicate that the account credentials have been compromised. In this case, the user should change the account password, review the trusted devices list, revoke any unrecognized devices, and contact Revolut support if suspicious activity continues.

If the SMS code does not arrive when logging into a new device, the first step is to wait a few minutes and request the code again. SMS delivery can be delayed by several minutes in some regions. If the code still does not arrive after multiple requests, the issue may be a SIM problem, carrier settings, or a temporary outage. Users can contact their mobile carrier to confirm that SMS is enabled on the account and that the number is active. Once SMS is confirmed to be working, retrying the Revolut login should succeed.

If biometric verification is not working, the user should check that Face ID or fingerprint is enabled on the phone itself and that the Revolut app has permission to use it. Some phone settings can disable biometric access system-wide or on a per-app basis. Re-enabling biometric authentication in the phone’s security settings and then granting the Revolut app permission to use it usually resolves the issue. Alternatively, users can always fall back to PIN or SMS verification if biometric is unavailable.

If a trusted device is not recognized after a fresh install or OS update, this may be because the device’s hardware identifier has changed, forcing a new device binding. Users should expect to go through verification again and approve the new device as if logging in for the first time. This is a normal security event and does not indicate account compromise. The app will learn the device identity again and return to faster verification on the next login.