A user enters their phone number and passcode on their Revolut app, but the authentication fails. They try again, then a third time. On the fourth attempt, the screen changes: their account is temporarily locked, and they cannot proceed until a waiting period expires. This is not a bug or a punishment—it is a deliberate security mechanism designed to block account takeover attempts before they succeed. Understanding how and why Revolut login attempts are limited is essential for both protecting your account and avoiding inconvenience when you are locked out.

The stakes of account security have become material for millions of users. Revolut serves over 70 million personal users globally, holding funds, investment positions, and linked payment methods. A compromised account can lead to unauthorized transfers, fraudulent transactions across 120+ countries, or theft of cryptocurrency holdings. The cost of account recovery after a breach often exceeds the cost of a few minutes of inconvenience during legitimate login. That calculation is why Revolut, like most modern financial services, implements automatic lockout thresholds and brute-force protection rather than allowing unlimited password attempts.

How many failed Revolut login attempts trigger a lockout

Revolut enforces a failure threshold before automatic account lockout occurs. The exact number of permitted failed attempts before a temporary block is implemented sits between three and five incorrect entries, depending on the authentication method and device context. When a user attempts to log in using their phone number with SMS-based verification, the system tracks consecutive failures. If that threshold is exceeded without a successful authentication, the account enters a locked state that prevents further login attempts for a defined period.

The critical distinction is between failed Revolut login attempts at the phone-number entry stage and failures during the multi-factor authentication step. An incorrect phone number may be handled differently from an incorrect SMS code or biometric failure. Similarly, a user who fails to authenticate on a previously unrecognized device may trigger more conservative thresholds than one logging in from a known and trusted phone. This device-binding context is why the same failed login behavior does not always produce the same lockout duration across different scenarios.

Revolut also distinguishes between a temporarily locked account and a permanently disabled account. A temporary block due to repeated failed login attempts is a security pause—it lasts minutes to hours. A permanent disablement, by contrast, results from account closure requests, regulatory action, or serious terms-of-service violations. Users locked out of their account after failed Revolut login attempts should expect the suspension to lift automatically; users who have been permanently disabled receive explicit notification and cannot restore access by waiting.

Automatic lockout duration and how it resets

Once a Revolut account is locked following failed login attempts, the lockout period typically lasts between 15 and 60 minutes, though the exact duration may vary based on the severity of the failed attempts and Revolut’s anti-fraud assessment at that moment. During this period, no further login attempts are permitted. The user receives an on-screen message indicating that their account is temporarily locked and directing them to wait or contact support.

The lockout timer resets when the waiting period expires. At that point, the user can attempt to log in again. Importantly, the counter for failed attempts also resets once a successful login occurs. This means that if a user fails three times, waits for the lockout to lift, and then logs in successfully on the first attempt after the pause, the failed-attempt counter returns to zero. Conversely, if the user fails again during the subsequent login window, those new failures accumulate toward a second lockout.

Geographic and temporal context may also influence the lockout duration. A login attempt from an unusual country or at an unusual time of day can trigger more aggressive anti-fraud measures, potentially leading to extended lockouts or requiring additional verification. Revolut’s anti-fraud monitoring system continuously evaluates whether a login attempt matches the user’s historical patterns. A user who typically logs in from London during business hours and then attempts access from Singapore at midnight may face stricter scrutiny than one following their established routine.

The automatic session timeout is a separate security layer from the failed-login lockout. Even after a successful Revolut login, the session may expire after a period of inactivity, typically 10 to 15 minutes, requiring re-authentication. This prevents unauthorized access if a device is left unattended or stolen. Users should not confuse a session timeout with a failed-login lockout; the remedies and durations differ.

Understanding Revolut’s anti-fraud architecture

Revolut’s anti-fraud system operates across multiple layers, and the failed-login lockout is only one defense. The broader system includes device binding, which associates a device with a user account during setup and flags subsequent logins from new or unrecognized devices. The revolut login process therefore includes steps designed to verify that the person attempting access is the legitimate account holder or an authorized secondary user.

When a user successfully completes Revolut login with multi-factor authentication, the app stores a device fingerprint—a combination of unique hardware identifiers, OS details, and settings that persist across sessions. If someone attempts to log in from a device that has not been previously authenticated, the system may require additional verification, such as email confirmation, SMS codes to a registered number, or biometric re-confirmation. This device-binding approach means that even if an attacker obtains a user’s phone number and passcode, they cannot immediately access the account from a different phone.

The anti-fraud monitoring also evaluates transaction patterns in real-time. After a successful Revolut login, if the user attempts to move funds in a way that deviates sharply from their history—such as a large international transfer to a new recipient or a cryptocurrency withdrawal—the system may place a hold on the transaction and request additional verification. This is distinct from the login lockout but complements it by providing a secondary checkpoint after authentication succeeds.

SMS and biometric authentication are the primary second factors in Revolut’s login flow. Face ID and fingerprint verification on iOS and Android devices provide a faster, more convenient alternative to typing SMS codes, yet they also reduce the risk that an SMS-intercept attack can compromise the account. However, if a user’s phone is stolen and the device’s biometric security is already breached, the attacker still needs to know or guess the initial phone number and passcode to reach the multi-factor step. The layering of these checks is intentional.

Why Revolut implements login attempt limits

The primary motivation for enforcing Revolut login attempt limits is to block brute-force attacks. A brute-force attack is an automated attempt to guess a password or passcode by trying many combinations in rapid succession. If an attacker could make unlimited attempts at Revolut account credentials, they could systematically test every possible four-digit PIN or common phrase until finding one that works. A limit on attempts, combined with an increasing delay between attempts, raises the computational and temporal cost of such an attack to the point where it becomes impractical.

A secondary motivation is to reduce the risk of account takeover through credential-stuffing attacks. In a credential-stuffing campaign, attackers use leaked username-password pairs from other breaches to attempt unauthorized access to popular services. Revolut, as a financial platform with valuable accounts, is a frequent target. By locking accounts after a small number of failed login attempts, Revolut prevents an attacker from quickly cycling through thousands of stolen credentials against thousands of accounts.

The threshold-based lockout also serves as an early warning system. Users who suddenly receive notifications that their account is locked due to failed login attempts know that someone may be attempting unauthorized access. This prompts the legitimate account holder to change their passcode, review recent activity, and ensure that their phone number and email are still under their control. In this sense, the lockout is not purely defensive; it is also informative, signaling a potential security incident before serious damage occurs.

From an operational perspective, the lockout reduces the load on Revolut’s authentication servers during attack periods. If attackers can make unlimited requests, they can consume server resources and degrade service for legitimate users. Enforcing a limit and a pause between attempts dampens this form of denial-of-service attack, protecting the infrastructure and ensuring that the service remains available to genuine users attempting normal Revolut login sequences.

What to do if your Revolut account is locked

The immediate first step is to stop attempting to log in. Each new failed attempt extends the likelihood of a longer lockout or escalation to manual review. Instead, wait for the lockout timer to expire. If a user knows that all of their recent login attempts were legitimate—they were simply entering their passcode incorrectly—they can reset their passcode through the account recovery flow, which typically requires email verification or SMS confirmation to their registered phone number.

If the user suspects that someone else attempted unauthorized access, changing the passcode is essential. This can usually be done through the Revolut account settings after a successful login, or through the password-reset flow if the account is still locked. Changing the passcode invalidates any credential-stuffing attacks or compromised credentials that an attacker may have obtained elsewhere. The user should also review their account activity, check for any unauthorized transactions, and enable any additional security features available in settings, such as transaction limits or transaction notifications.

For users who are repeatedly locked out despite entering the correct passcode, the issue may be a caching problem, a software bug, or a genuine account security flag. In such cases, contacting Revolut support through the in-app messaging system, email, or phone is necessary. Support can verify the user’s identity through additional means and either manually unlock the account or help identify the underlying cause. Support will not be able to override the automatic lockout immediately, but they can accelerate resolution and investigate whether the lockout is warranted.

Users should also ensure that they are using the most recent version of the Revolut app. Older versions may have authentication bugs or compatibility issues that cause login failures. Updating to the latest version from the Apple App Store or Google Play Store can resolve spurious lockouts. Similarly, clearing the app cache and reinstalling the app, if necessary, can eliminate local data corruption that interferes with the authentication process.

Preventing repeated lockouts through account security practices

The most straightforward way to avoid a Revolut account locked state is to ensure that your passcode is entered correctly and that you are logging in from a familiar device. Write down your passcode in a secure location, such as a password manager or a physical notebook stored safely, so that you do not rely on memory alone. Revolut does not use traditional passwords; instead, it uses a numeric passcode typically four to six digits long. This brevity makes memorization easier but also increases the risk of casual guessing, so treat the passcode with the same confidentiality as a PIN.

Enable biometric authentication (Face ID or fingerprint) if your device supports it. Biometric login is both more convenient and more secure than typing a passcode, and it is faster than waiting for an SMS code. If you lose access to your biometric authentication—for example, if you update your phone—ensure that you still remember your passcode or have it stored securely before attempting a Revolut login on the new device.

Register and verify all contact information associated with your Revolut account. Ensure that your phone number is current and that you have access to the email address on file. If your phone number changes, update it in the account settings before the old number is reassigned to another user. If an attacker gains access to your phone number through a carrier transfer or SIM swap, they can intercept SMS codes and potentially bypass the multi-factor authentication. This is why Revolut recommends using biometric authentication where possible and considering additional security measures such as a PIN with your mobile carrier to prevent unauthorized transfers.

Monitor your account activity regularly. Revolut provides a transaction history and a notification system that alerts users to logins, transfers, and other account changes. Review these notifications and disable any that you do not recognize. If you see a login from a device or location that you do not recognize, immediately change your passcode and contact support. Early detection of unauthorized access can prevent larger losses and gives support a clearer picture of what happened.

Regional differences in Revolut login security policies

Revolut operates through region-specific licensed entities, including Revolut Ltd for UK customers and Revolut Bank UAB for EU customers, as well as separate entities in other jurisdictions. These regional entities may implement slightly different security policies, including variations in login attempt limits and lockout durations. A user in the UK may experience a different lockout behavior than a user in the EU or in a different country.

Regulatory requirements also influence login security. The EU’s Payment Services Directive (PSD2) mandates strong customer authentication for electronic payments above certain thresholds, which influences how Revolut implements multi-factor authentication. UK regulations, following the UK’s departure from the EU, have their own requirements. Users in different regions should not assume that lockout durations or failed-attempt thresholds are identical across the Revolut platform.

Additionally, the availability of certain login methods may vary by region. SMS authentication is available globally, but biometric authentication availability depends on the user’s device. Users in some jurisdictions may have access to alternative verification methods, such as in-app push notifications or hardware security keys, while others may not. When traveling or accessing Revolut from a new country, users should be aware that the login experience and security prompts may differ from what they are accustomed to domestically.

The relationship between login security and account recovery

A critical but often overlooked aspect of account security is the recovery process. If a user forgets their passcode or loses access to their phone, the ability to regain control of their Revolut account depends on recovery mechanisms that Revolut has put in place. During the initial account creation, users must complete Know-Your-Customer (KYC) identity verification, which establishes a verified identity linked to the account. This verification becomes the foundation for recovery if the user cannot perform a normal Revolut login.

If a user is locked out and cannot regain access through a passcode reset or SMS verification, Revolut support can conduct additional identity verification to confirm ownership of the account. This process may require providing copies of identity documents, proof of address, or answering security questions established during signup. The thoroughness of this process is why account recovery can take several hours to several days, but it also prevents attackers from using a fake recovery process to compromise accounts.

Users should therefore treat their registered email and phone number as critically as their passcode. If an attacker gains access to both the account credentials and the recovery contacts, they can lock the legitimate user out of their account while simultaneously changing the recovery credentials to themselves. The defense against this scenario is to maintain strong authentication on your email account and to consider using two-factor authentication on the email account as well. Email is often the master key to account recovery across many services, and it deserves equivalent protection.