Every time a user opens Revolut and enters their phone number followed by an SMS code and biometric verification, a chain of data collection begins. The fintech platform, which serves over 70 million personal users globally, does not use traditional passwords. Instead, it relies on phone number-based authentication combined with multi-factor verification and device binding. Understanding what information Revolut collects during the login process—and how that data flows through the company’s infrastructure—is essential for users who store banking details, investment accounts, and cryptocurrency holdings within a single application.

The mechanics of Revolut login appear straightforward on the surface: enter a phone number, confirm an SMS code, unlock with Face ID or a fingerprint, and access your account. What remains opaque to most users is the extensive ecosystem of device identifiers, biometric templates, IP addresses, and behavioral signals that the platform collects and processes to authenticate each session. Revolut operates through region-specific licensed entities including Revolut Ltd for UK customers and Revolut Bank UAB for EU customers, each subject to different regulatory oversight. Yet the authentication infrastructure and the data it generates exist across these boundaries, creating a complex picture of what information is accessed and retained.

Phone number and SMS verification: The foundation of Revolut login

Revolut’s authentication system begins with a phone number rather than an email address or username. When a user initiates revolut login, they enter their phone number, and the system sends a one-time code via SMS. This mechanism serves multiple purposes: it confirms possession of the registered device, provides a time-limited factor that cannot be reused, and creates an audit trail linking authentication attempts to specific phone numbers and timestamps.

The SMS code itself is typically valid for 10 minutes and can usually be attempted multiple times before the system locks out further attempts. Each attempt generates a server-side log that records the phone number, the timestamp of the request, the IP address from which the code was entered, and whether the code was accepted or rejected. These logs are retained for fraud detection, regulatory compliance, and security investigation purposes. Users should note that SMS delivery is not encrypted in transit; the code travels through telecommunications infrastructure that Revolut does not control. An attacker who intercepts or intercepts the SMS message before it reaches the device can gain temporary access to the account if other security measures are not in place.

Revolut’s security architecture addresses this vulnerability partially through automatic session timeouts. If a user enters the SMS code but does not complete the next authentication step within a defined period, the code expires and a new one must be requested. This reduces the window during which an intercepted code remains valid. However, the phone number itself remains the linking factor between the SMS delivery and the user’s account. Phone number changes, SIM swaps, and porting attacks can compromise this foundation. Revolut requires users to confirm SIM changes through additional verification steps, but the process depends on whether the user notices and reports the change promptly.

Biometric data collection and device-level authentication

After the SMS code is verified, Revolut requires biometric authentication using either Face ID (on iOS devices with compatible cameras) or a fingerprint sensor (on most modern Android and iOS devices). This biometric data is not sent to Revolut’s servers. Instead, the biometric template is stored on the device itself, within the hardware-backed security enclave (Apple’s Secure Enclave on iOS or the Trusted Execution Environment on Android). The device compares the user’s presented biometric—face or fingerprint—to the stored template and returns only a yes/no result to the Revolut app.

This architecture is stronger than transmitting biometric data to a central server, where it could be intercepted, stored, or breached. However, Revolut still collects metadata about each biometric authentication attempt. This includes the timestamp of the attempt, whether authentication succeeded or failed, the device identifier, and the version of the app and operating system in use. A pattern of repeated failed biometric attempts can trigger additional security measures, such as requiring an SMS code to retry or temporarily blocking access to the account. These security decisions require Revolut to process the sequence of failed attempts, which means the company has visibility into how often a user attempts to unlock their account and from which devices.

The biometric system also creates a dependency on device security. If a device is stolen and the thief can bypass the device’s own lock screen (through forceful methods, malware, or physical forensics), they may be able to use the stored biometric template to unlock the device and then authenticate to Revolut without needing a new SMS code. Revolut mitigates this through device binding, but a compromised device remains a significant attack surface. Users who add a new device to their Revolut account must re-authenticate through SMS, which provides a check against immediate account takeover if a device is lost.

Device identifiers and machine fingerprinting

Revolut collects multiple device identifiers during login to bind the authentication session to a specific hardware configuration. The most common identifiers include the device’s IMEI (International Mobile Equipment Identity) number, the advertising ID (Android) or Identifier for Advertisers (iOS), the device’s hardware serial number, and a unique identifier generated by Revolut’s SDK when the app is first installed. These identifiers are used to detect when an account is being accessed from a new or unusual device, which can trigger additional verification steps or alert the user to suspicious activity.

Device fingerprinting goes beyond a single identifier. Revolut’s client-side code also collects information about the device’s OS version, app version, screen resolution, installed font libraries, active applications running in the background, and network characteristics (such as whether the device is on WiFi or cellular, and the ISP providing the connection). This fingerprint is included with each authentication request and compared against historical patterns for that account. If a user logs in from a new location, a new device, or at an unusual time, the fingerprint triggers fraud detection rules that may require additional verification or manual review.

The granularity of this collection is important because it enables Revolut to offer a convenient experience (users on the same device are not repeatedly re-prompted for verification) while also providing a surveillance capability. The company can see which devices have authenticated to an account, when they authenticated, and from where. If law enforcement or another third party requests account data from Revolut, this device history becomes part of the subpoenaed record. For users who value privacy, understanding that device identifiers are collected and retained is a prerequisite to making informed decisions about shared devices, public WiFi networks, and whether to enable app installation across multiple phones.

IP address logging and geolocation data

Every Revolut login request includes the IP address of the device initiating the connection. Revolut logs this IP address along with the timestamp, authentication method, success or failure status, and device identifiers. The IP address can be used to infer the user’s approximate geographic location through IP geolocation databases. If a user typically logs in from London and suddenly attempts to access their account from Singapore, the geographic discrepancy can trigger a velocity check or deny the request outright, requiring the user to confirm the login through additional means such as an email confirmation link or a support contact.

Revolut also collects information about the network the device is connected to. When a device is on WiFi, the SSID (network name) may be exposed in some app contexts, though Revolut’s privacy practices generally do not capture this. However, the DNS requests made by the device and any proxy or VPN configuration can sometimes be inferred from network behavior. Users who employ a VPN to protect their IP address should be aware that Revolut may flag the VPN exit node’s IP as a high-risk location if it does not match the user’s historical login patterns. Some VPNs rotate IP addresses frequently, which can create a pattern of apparent logins from many countries simultaneously—a pattern that Revolut’s fraud detection systems view as suspicious.

The retention period for IP logs varies by jurisdiction. EU regulations under GDPR generally require that IP addresses be treated as personal data and deleted or anonymized within a defined period (often 90 days) unless there is a specific legal basis for longer retention. UK regulations under UK GDPR have similar requirements. However, Revolut’s exact retention policies are not publicly detailed in fine-grained terms, and law enforcement requests may compel retention or disclosure of historical IP logs even after the user’s stated retention period has passed. Users who are concerned about IP address logging should review Revolut’s privacy policy and consider whether the trade-off between authentication convenience and location privacy is acceptable for their threat model.

Behavioral analytics and authentication pattern matching

Beyond the explicit authentication factors (SMS code, biometric, device identifier, IP address), Revolut’s security systems collect and analyze behavioral signals to detect account abuse. These signals include the time of day the user typically logs in, the frequency of login attempts, the day of the week, the intervals between sessions, and the geographic pattern of logins. Machine learning models process this behavioral data to calculate a risk score for each authentication attempt. A high-risk score may trigger additional verification steps, such as asking the user to confirm their full name, the last four digits of their registered card, or recent transaction amounts.

This behavioral profiling is effective at detecting account takeovers by attackers who do not have access to the user’s phone or biometric data. However, it also means that Revolut’s servers analyze and retain detailed information about each user’s access patterns. A user who travels frequently, works night shifts, or accesses their account from multiple locations may trigger more frequent risk checks and additional verification requirements. The algorithms underlying these behavioral models are proprietary and not disclosed to users, so users cannot fully understand what patterns flag their accounts as suspicious or how Revolut’s system classifies normal versus abnormal activity.

The behavioral data also feeds into Revolut’s broader anti-fraud monitoring system, which shares information across the customer base to identify coordinated attacks or emerging fraud patterns. If multiple accounts are compromised and funds are transferred to the same destination, Revolut’s system may flag all the intermediate steps—including the successful logins—as part of a fraud ring. This collective approach to fraud detection means that each user’s login patterns contribute to a shared model that affects how future logins are scored for everyone. Users do not have visibility into how their specific data influences these shared models or what policy adjustments Revolut makes based on the aggregate data.

Regulatory compliance and identity verification data linkage

Revolut login is intrinsically linked to the company’s identity verification process, which occurs during initial signup. Users must pass Know Your Customer (KYC) checks by providing government-issued identification, proof of address, and in some cases, additional information about the source of funds or the intended use of the account. This identity verification data—including scans of passport or national ID documents, facial images captured during the verification process, and proof of address documents—is stored and associated with the account credentials used for login.

When a user attempts to log in, Revolut’s system can immediately link the login event to the verified identity. This is particularly important for regulatory compliance; Revolut is required by anti-money laundering (AML) and know-your-customer regulations in every jurisdiction where it operates to maintain records of who accessed an account, when, and from where. The verified identity information is also used in the fraud detection system; if an attacker gains access to an account and attempts to change the registered phone number or email address, the system can check whether the change request comes from a device or location consistent with the verified identity holder.

For users in the EU, this linkage between login events and verified identity is subject to GDPR’s purpose limitation principle, which requires that personal data collected for one purpose not be used for unrelated purposes without explicit consent. However, Revolut argues (and regulators have generally accepted) that anti-fraud and account security purposes are aligned with the original purpose of KYC, so the data linkage is justified. Users should understand that their Revolut login is not anonymous; every authentication event is recorded against their verified legal identity, and regulatory authorities in the UK and EU can subpoena these records for law enforcement or tax compliance investigations.

Third-party data sharing and the authentication ecosystem

Revolut does not authenticate users entirely in isolation. The login process involves several third parties, each of which receives and processes authentication-related data. The SMS code is delivered by a telecommunications provider selected by Revolut (typically a carrier or MVNO), which receives the phone number and timestamp. The device’s operating system (Apple or Google) verifies the biometric and returns a success/failure signal. The IP address is routed through internet service providers and may pass through content delivery networks or DDoS mitigation services. Revolut may also use third-party fraud detection services that receive device fingerprints, IP addresses, behavioral signals, and authentication attempt histories.

These third parties typically operate under data processing agreements that specify how they can use the data and for how long they can retain it. However, the agreements vary in their specificity and enforceability. A fraud detection vendor, for example, may retain device fingerprints across multiple clients to build a more comprehensive model of normal versus abnormal authentication patterns. This means that a Revolut user’s device fingerprint could be processed and analyzed by companies the user has no direct relationship with, in contexts the user may not expect.

Revolut’s privacy policy discloses that the company shares data with third parties for fraud prevention, regulatory compliance, and service delivery. However, the specific list of third parties, the exact data elements shared with each, and the retention periods are not always detailed in user-accessible language. Users who request a data subject access request (DSAR) under GDPR or the UK Data Protection Act can obtain a full accounting of what data Revolut has collected, including all third-party sharing, but this process typically requires 30 days and formal submission rather than being immediately available through the app settings.

What users can control and what remains fixed

Revolut’s authentication system offers some user-controllable settings, but many data collection and processing activities cannot be disabled without sacrificing security or account access. Users can enable or disable biometric authentication in favor of SMS-only login, which slightly reduces the biometric data retained on the device but does not prevent SMS logs, IP logging, device identifier collection, or behavioral analysis. Users can also log out of previous sessions from a dedicated settings page, which terminates the session token for those devices but does not delete the historical record that they authenticated from those devices.

What users cannot control includes the collection of device identifiers, IP addresses, timestamp data, and behavioral signals. These are fundamental to Revolut’s fraud detection system and are collected regardless of user preference. Similarly, the linkage between login events and verified identity data is mandated by regulatory requirements and cannot be opt-out. Users who want to minimize data collection should understand that using Revolut inherently involves accepting Revolut’s security and compliance data collection practices; there is no “privacy mode” for authentication that removes these elements.

The most practical user control is the choice of devices on which to enable Revolut access. Limiting the number of devices that have biometric authentication enabled, avoiding login from public WiFi networks or untrusted devices, and regularly reviewing the list of devices with active sessions can reduce the total amount of device fingerprint data and login event data generated. However, these controls address only the quantity of data, not the fundamental architecture of what Revolut collects during authentication. Users should approach Revolut login as inherently tied to centralized data collection, and make security decisions accordingly rather than assuming that Revolut login provides privacy by default.