A Revolut user opens the app on their iPhone or Android phone and unlocks it with Face ID or a fingerprint instead of typing a password. The transaction completes in seconds. But behind that convenience lies a critical question: does the phone cache biometric credentials after authentication, and what becomes of that cached data if the device is stolen, lost, or seized by law enforcement? Understanding the answer requires examining how biometric systems actually work on mobile platforms, where credentials reside, and what protections exist when possession of the device changes hands.

Revolut’s revolut login process uses phone number-based authentication combined with biometric verification rather than traditional passwords. This design improves user experience but raises legitimate concerns about data persistence, cache exposure, and recovery mechanisms. The distinction between biometric templates stored locally, authentication tokens held in memory, and encrypted session data is more than technical detail—it directly affects whether someone with brief physical access to an unlocked phone can drain accounts or transfer funds.

How biometric login actually works on iOS and Android

Biometric authentication on modern mobile platforms does not transmit fingerprints, facial geometry, or any recognizable biometric data to an app or server. Instead, the operating system maintains a secure enclave—a hardware-isolated processor on iOS devices and a Trusted Execution Environment (TEE) on Android—where biometric templates are encrypted and stored. When a user presents their fingerprint or face, the phone compares a live sample against the stored template entirely within that secure enclave without exposing either the template or the comparison result to the main operating system or any app.

This architectural isolation is foundational to Revolut biometric login security. When you unlock the Revolut app with Face ID, the phone performs the match in the secure enclave and returns only a yes-or-no result to the app. The app never sees your face, your fingerprint, or the encrypted template. Apple’s Secure Enclave and Android’s TEE are hardware-backed security modules designed to remain isolated even if the main processor or operating system is compromised. The biometric comparison happens in that protected zone and cannot be intercepted or replayed by malware running on the device.

However, hardware isolation does not mean the phone stores nothing retrievable. After a successful biometric match, the secure enclave or TEE generates a cryptographic key or token that the app can use to authenticate the user’s session. This token—not the biometric template itself—is what gets cached locally or sent to Revolut’s servers to establish trust. The token has a limited lifetime and may require periodic re-authentication. Understanding this difference is critical: the biometric template is never cached in the app’s memory or storage. What is cached is the authorization credential derived from the successful biometric verification.

Revolut’s local credential and token storage model

After successful Revolut biometric authentication, the app stores an encrypted session token or authorization certificate on the device, often held in the phone’s secure storage mechanism. On iOS, this typically uses the Keychain, a hardware-encrypted store managed by the secure enclave. On Android, the equivalent is usually the AndroidKeyStore, which similarly uses hardware-backed encryption on supported devices. These systems are designed to survive a factory reset or a stolen backup only if the thief can also unlock the device.

Revolut biometric login relies on this token-based approach rather than storing passwords or biometric data directly. The token represents permission to access the account and is bound to the specific device through device-level encryption. If you lose your phone or it is stolen, that token becomes inaccessible to an attacker unless they also crack the device’s PIN or biometric lock. However, a critical vulnerability emerges if the phone is unlocked before it is lost or stolen. An attacker with an unlocked device can often access active sessions without needing to re-authenticate because the token is already present and valid in the secure storage.

Session timeouts mitigate this risk. Revolut implements automatic session expiration after a period of inactivity, forcing re-authentication after a timeout window (often 15 to 30 minutes, depending on transaction sensitivity and regional rules). This means that even if an attacker gains access to an unlocked phone, they have only a limited time window during which they can perform actions without triggering another biometric prompt. Critical operations such as adding a new payment method, initiating a large transfer, or changing security settings often require explicit re-authentication regardless of the session state.

What happens if your phone is stolen while unlocked

If someone steals your phone while it is unlocked and an active Revolut session exists, they can perform transactions until the session expires or until you remotely disable the device. This is a real and urgent risk. The attacker cannot see your biometric data or derive your PIN, but they can spend money, transfer funds, or change account settings within the window that the cached token allows. The severity depends on whether Revolut enforces transaction limits, velocity checks, or step-up authentication for high-value actions.

Transaction velocity controls—limits on how much can be moved in a given time period—can slow an attacker but may not stop them if the limit is substantial. A thief with an unlocked phone might move smaller amounts multiple times, withdraw cash, or add a new card to external accounts. The most dangerous scenario is one in which high-value transfers or account changes do not require a second authentication step beyond the cached session. This is why Revolut security architecture should ideally require biometric re-authentication for sensitive operations even within an active session, not just for login.

The practical response to a lost or stolen phone is immediate action: contact Revolut support, report the device as lost or stolen, and request that the app session be terminated remotely. Revolut operates through region-specific licensed entities such as Revolut Ltd for UK customers and Revolut Bank UAB for EU users, each with its own fraud response protocols. The sooner you report the loss, the sooner Revolut can revoke the session token from the server side, rendering any cached token on the stolen device useless. Many users underestimate how quickly they must act; every minute of delay increases the window for an attacker to move funds.

Device binding and biometric template security

Modern iOS and Android phones use hardware-level device identification to bind security credentials to a specific phone. When you set up Revolut biometric login for the first time on a new device, the app registers that device with Revolut’s backend systems using a hardware identifier (such as the phone’s IDFA on iOS or a cryptographic device ID on Android). This creates a binding between your account and that specific device. If someone attempts to use your Revolut credentials on a different phone, the backend detects a mismatch and typically demands additional verification or blocks the login entirely.

Device binding prevents a thief from logging into your Revolut account on their own phone using your credentials, even if they somehow obtained your phone number or recovery codes. However, device binding does not help if the thief is using your stolen phone itself—in that scenario, the device is already registered and trusted. This is why the focus must shift to session management and immediate revocation. Device binding is a defensive measure against credential compromise; it is not a substitute for session timeout or remote session termination.

The biometric template itself remains the responsibility of the operating system. Apple and Android maintain these templates in the secure enclave or TEE and never expose them to third-party apps like Revolut. However, a compromised operating system kernel, a malicious system update, or a zero-day exploit in the secure enclave could theoretically expose biometric data. These are rare scenarios but not impossible. Users who operate in high-threat environments should be aware that no security measure is absolute and that physical device control is ultimately the foundation of all mobile security.

Comparison: Revolut Face ID versus fingerprint and their cache behavior

Face ID and fingerprint authentication both rely on the same underlying secure enclave or TEE architecture, but they differ in presentation and user behavior patterns. Revolut Face ID on iPhones requires the user to look at the phone and is less likely to be coerced in public (an attacker cannot force you to look in a particular direction without your cooperation, whereas they might pressure you to place a finger on the sensor). Fingerprint authentication is faster in many contexts and does not require the phone to be at eye level.

From a caching perspective, both methods produce identical results: a session token stored in encrypted local storage after successful authentication. The token itself does not differentiate between Face ID and fingerprint; it represents only that the phone’s owner (or someone in possession of the phone who knew the PIN bypass) was authenticated. Neither biometric method creates a larger or smaller cache footprint. The difference in security emerges from behavioral and usability factors rather than from how the cache is managed.

One practical distinction is that Revolut fingerprint login may work even if the phone screen is off, whereas Face ID requires the user to unlock the phone first (or at minimum to look at it). This means that a thief with an unlocked iPhone may find it harder to use Face ID if the screen has timed out, whereas a fingerprint-protected Android phone might allow authentication directly. The difference is marginal because both devices have session timeout mechanisms that force re-authentication after inactivity.

Revolut security beyond biometric login

Biometric authentication is one layer of Revolut’s security model, not the entire foundation. The platform also employs multi-factor authentication (MFA) for account login if you do not use the app, anti-fraud monitoring that detects unusual activity patterns, IP address reputation checks, and geographic velocity checks. If you log in from a new country within an implausibly short time window, Revolut’s systems may block the login or demand additional verification even if the biometric match succeeded.

Anti-fraud monitoring operates continuously and can override normal session permissions. A stolen phone attempting to send a large wire transfer to a new recipient in a new country may trigger a challenge that requires SMS verification or another form of out-of-band authentication. These checks occur on the server side and cannot be bypassed by an attacker who has only the phone. They represent a second perimeter that persists even if the device’s local security is compromised.

However, anti-fraud systems are probabilistic, not deterministic. They flag suspicious activity based on pattern analysis and machine learning models, which means an attacker might occasionally slip through if their behavior matches normal user patterns. A transfer to a domestic account from your usual location might not trigger additional scrutiny. This is why layered security is essential: biometric login, session management, device binding, transaction limits, and server-side monitoring all work together. Failure in any single layer does not guarantee account compromise, but it increases the risk incrementally.

Recovery, account access, and what happens if biometrics fail

If your phone loses the ability to scan your biometric data—due to a broken sensor, software corruption, or a factory reset—you need an alternative authentication method to regain account access. Revolut typically falls back to SMS-based authentication using your phone number and an OTP (one-time password). This means your phone number becomes a critical recovery factor. If someone has control of your phone number through SIM swapping or carrier exploitation, they can bypass your biometric protection entirely and regain access to your account.

This is a known vulnerability in any system that relies on phone-number-based recovery. The strongest protection is to set up additional verification factors—such as backup codes, a hardware security key (if Revolut supports it), or a second email address registered with your carrier—to prevent unauthorized SIM changes. Many security incidents begin with SIM swapping, not with stolen phones or cracked biometrics. A Revolut user whose phone number is vulnerable to takeover faces a threat that no amount of biometric security can fully mitigate.

Some users also keep backup login methods such as an emergency access code or a recovery phrase. These should be stored offline and securely, never in cloud services, messaging apps, or email. If you have set up any such backup methods, an attacker who gains access to your phone and your backup storage location could potentially restore access even after you have reported the phone lost.

Practical recommendations for protecting Revolut biometric login

The first and most important step is to keep your phone locked. Set a strong PIN (not a simple number sequence) and enable biometric authentication. If your phone supports it, use a long alphanumeric PIN rather than a short numerical one, as this makes brute-force attempts much slower. Ensure that biometric fallback (allowing login after a set number of failed attempts) is disabled, forcing the attacker to use the PIN instead.

Second, enable Revolut’s session timeout to its shortest practical duration. Some users are tempted to extend the timeout for convenience, but a shorter timeout (such as 15 minutes) significantly reduces the damage window if the phone is stolen. The minor inconvenience of re-authentication outweighs the risk of unattended access.

Third, monitor your account actively. Check transaction history, recent logins, and device registrations regularly. Many users discover theft only when reviewing statements, which can be weeks after the incident. Setting up transaction alerts or push notifications for sensitive actions can provide earlier warning. Revolut allows you to receive alerts for transfers above a certain threshold; use this feature with a threshold you can afford to ignore only if the transaction is legitimate.

Fourth, maintain control of your phone number and email. Implement protections with your carrier to prevent SIM swapping: set up a PIN with them, request that no SIM changes be made over the phone, and verify any SIM change requests in person at a store. For your email, enable a strong password and multi-factor authentication that does not rely on your phone number.

Finally, if you travel or enter a high-risk environment, consider whether you should carry a device with Revolut installed at all, or whether you should deactivate Revolut biometric login before travel and re-enable it afterward. This reduces the attack surface if your phone is lost or confiscated during travel. Some business users also maintain separate phones for personal and work use, limiting the consequences if one device is compromised.