Revolut’s authentication model has shifted significantly since its early days of static passwords. The platform now prioritizes phone number-based login combined with biometric verification, offering users a balance between convenience and security that reflects modern mobile banking expectations. For the majority of Revolut’s 70+ million users, the login experience depends on whether biometric authentication has been configured on their device—a choice that affects both access speed and the underlying security architecture.

Setting up biometric login on Revolut requires understanding how Face ID and fingerprint authentication integrate with the app’s device binding and multi-factor authentication layers. This is not simply enabling a toggle in settings. It involves device compatibility checks, hardware capability validation, and understanding what happens when a biometric fails or a device is lost. The process differs subtly between iOS and Android, and the security benefits depend on how users configure and maintain their biometric profiles.

Understanding Revolut’s passwordless login architecture

Revolut login no longer depends on remembering or storing a complex password. Instead, the system uses a phone number as the identity anchor, combined with a one-time code delivered via SMS or push notification, followed by an additional 4–6 digit passcode and biometric verification if enabled. This layered approach is sometimes called passwordless authentication, though it is more accurately described as multi-factor authentication without a static password. The distinction matters because each factor serves a different security function.

The phone number verifies that you control the registered device. The SMS or push code confirms that you have access to that device in real time. The passcode and biometric layer adds friction that prevents casual access even if someone temporarily has your phone. This architecture shifts the security boundary from a password database—which could be stolen—to the phone number itself and the SIM card or mobile device bound to it. A compromised phone number through SIM swapping becomes a real risk, while a weak password no longer is.

Device binding is the structural foundation that makes biometric login meaningful in this context. When you first enable Revolut biometric login on a device, the app stores an encryption key on that phone or tablet linked to your Revolut account. Subsequent biometric attempts verify against that key rather than contacting Revolut’s servers for every unlock. This reduces latency and network dependency, but it also means that if a device is stolen and a biometric profile is compromised, the attacker may have a faster path to your account.

Understanding this architecture helps explain why Revolut login requires not just biometric setup but also awareness of device security. If your phone’s Face ID or fingerprint system is compromised—through a spoofed biometric or malware—the device binding may not protect you. If a device is stolen before you have time to remotely lock your account, the combination of stolen device, biometric, and passcode knowledge could grant access. The security benefit of biometric login therefore depends as much on device care as it does on the biometric technology itself.

Setting up Face ID for Revolut biometric login on iOS

iOS devices with Face ID—iPhone X and later models—offer one of the most seamless biometric login experiences available on Revolut. The setup process begins in the Revolut app’s security settings, accessible from the menu or account section. You will find a “Biometric Authentication” or “Face ID” toggle. Before enabling it, ensure that Face ID itself is already configured in iOS Settings under Face ID & Passcode. Revolut cannot enable Face ID; it can only request permission to use the system that iOS provides.

Once you tap the Face ID toggle in Revolut, the app will present iOS’s biometric permission prompt. This is a system-level request that grants Revolut the ability to call the Face ID service. Grant the permission, and Revolut will create a device-specific encryption key associated with your account. The system then prompts you to perform a Face ID scan directly in the Revolut app to verify that biometric enrollment is working correctly. You do not need to re-enroll Face ID; you are simply allowing Revolut to authenticate against the existing Face ID data stored in the Secure Enclave, Apple’s isolated hardware security processor.

After successful setup, your next Revolut login will use Face ID after the initial SMS or push code confirmation. The sequence is: enter phone number, receive and confirm the SMS or push notification code, optionally enter your passcode, and then present your face to the Face ID sensor. If Face ID fails—due to lighting conditions, a changed appearance, or the sensor malfunctioning—Revolut will offer a fallback option to enter your 4–6 digit passcode instead. This fallback is critical for accessibility and reliability; it ensures that a biometric failure does not lock you out of your account.

One detail that often surprises users: Face ID on iPhone uses adaptive matching, meaning the system learns slight variations in your appearance over time. However, Revolut’s use of Face ID is instantaneous and does not require network connectivity if the device-binding key is present. This offline capability is both a strength and a potential vulnerability. If someone has physical access to your stolen iPhone and can present your face while it is still in an unlocked state, they may be able to authenticate to Revolut without an internet connection, at least until the app refreshes its session status.

Fingerprint authentication setup on Android with Biometric API

Android devices use a different biometric framework than iOS. Rather than a single Face ID system, Android offers fingerprint, face recognition, and other biometric modalities through the Android Biometric API, a standardized interface that apps use to request biometric authentication. Revolut’s Revolut biometric login on Android relies primarily on fingerprint sensors, though some newer Android devices also support face unlock. The setup process is similar in principle to iOS but depends on which biometric modality is available on your specific device.

To enable biometric login on Android, open Revolut, navigate to security settings, and look for “Biometric Authentication” or “Fingerprint Login.” Tap the toggle, and Android will present a permission request to allow Revolut to use the Biometric API. Grant the permission. Revolut will then prompt you to place your finger on the sensor to enroll the biometric for the app. Unlike iOS, where Face ID is centrally enrolled in the operating system, Android allows per-app biometric enrollment. This means you might have a different fingerprint profile for Revolut than for unlocking your phone, or you might have enrolled only one finger for your phone but multiple fingers in Revolut.

The advantage of per-app biometric enrollment is granularity: Revolut can require a specific finger or a more strict matching threshold than your phone’s general unlock. The disadvantage is that a compromised Revolut biometric does not necessarily require the attacker to compromise your phone’s unlock, but it also means that an attacker who accesses both has two separate biometric attacks to execute. After enrolling your fingerprint in Revolut, the app creates a device-binding key similar to iOS. Subsequent logins will use fingerprint authentication as the final step, after the SMS or push code and optional passcode.

Android’s biometric system is less centralized than iOS because different device manufacturers integrate biometric sensors differently. A Samsung device with an ultrasonic fingerprint sensor buried under the screen presents the sensor differently than a phone with a side-mounted capacitive sensor. Revolut’s biometric integration must account for these variations, which is why compatibility depends on your specific Android model and manufacturer. If your device’s biometric hardware is not properly recognized, Revolut may not offer the biometric login option, or it may be grayed out in settings.

Testing your Android biometric setup is straightforward. After enabling fingerprint authentication for Revolut, log out of the app, then attempt to log back in using your phone number. Once you confirm the SMS or push code, you should be prompted to place your finger on the sensor. Try different fingers to ensure that you have successfully enrolled the ones you plan to use. If authentication fails repeatedly, check that your finger is clean and dry, and that you are applying consistent pressure. If the sensor itself is not responding, your device may have a hardware issue unrelated to Revolut.

Passcode fallback and security layers during Revolut authentication

The 4–6 digit passcode that appears during Revolut login serves as the critical fallback when biometric authentication is unavailable or fails. This passcode is not your phone PIN and is not the same as your SMS one-time code. It is a persistent credential that you set during account creation or in your security settings. When Revolut biometric login is enabled, the sequence is: SMS or push code, then passcode, then biometric. If biometrics fail, you can revert to the passcode without re-requesting the SMS code.

This layering creates an important security property: Revolut security does not collapse if biometrics are temporarily unavailable. A traveler in low-light conditions, a user whose face or fingerprint has changed, or someone with a malfunctioning sensor can still access their account using the passcode. At the same time, the passcode itself is an additional secret that an attacker would need to know in addition to your phone number and biometric. The combination of SMS verification, passcode, and biometric is designed to be resistant to single-point-of-failure attacks.

However, if an attacker has your phone and knows your passcode, the biometric becomes less valuable—they could simply enter the passcode instead. The real protection in this scenario comes from anti-fraud monitoring and session timeouts. Revolut tracks unusual login patterns, such as logins from new devices or multiple failed attempts. If suspicious activity is detected, the system may require additional verification, such as confirming a link sent to your registered email or phone number. Session timeouts also mean that simply having your phone does not grant permanent access; after a period of inactivity, the app will require re-authentication.

Device compatibility and hardware requirements across platforms

Not every device can support biometric login on Revolut. The minimum requirements differ between iOS and Android. On iOS, you need an iPhone with Face ID, which means iPhone X or later. Older iPhones with only Touch ID fingerprint sensors cannot use Face ID with Revolut, though they can still use the SMS code and passcode. Some iPhone models with Face ID but older biometric hardware may experience compatibility issues with specific Revolut app versions, so keeping your app updated is important for reliable biometric performance.

On Android, the requirements are less uniform because so many devices and manufacturers exist. You need an Android phone with a functioning biometric sensor—either fingerprint or face recognition—that implements the Android Biometric API correctly. Most devices from the past five years support this. However, budget phones, older models, or devices with non-standard biometric implementations may not. If your Android device does not show the biometric authentication option in Revolut, it likely lacks the necessary hardware or API support.

A second compatibility consideration is operating system version. Revolut requires a minimum iOS version (typically the current version or one version back) and a minimum Android version to maintain security standards. If your device is on an older OS, you may be unable to update Revolut to a version that supports the latest authentication features, including biometric login. This is a deliberate security restriction: older operating systems have known vulnerabilities that could compromise the Secure Enclave on iOS or the Android Keystore on Android, both of which protect the biometric enrollment and device-binding keys.

Device storage and RAM are generally not constraints for Revolut biometric login, but battery health can matter for biometric sensors. On some phones, a degraded battery can cause the fingerprint sensor to become less responsive. This is usually temporary and resolves after charging, but users with aging devices should be aware that biometric reliability may decline. Testing your biometric authentication regularly—perhaps once a week by logging out and back in—helps catch these issues before they prevent access during a time-sensitive transaction.

Managing multiple devices and re-enrolling biometrics after upgrades

Revolut allows you to use the same account on multiple devices, each with its own device binding and biometric profile. This is both convenient and a potential security consideration. If you have Revolut installed on your phone, tablet, and smartwatch, each device can use its own biometric authentication—the device binding key is unique to each device. However, this also means that if one device is stolen, an attacker has a biometrically-authenticated route to your account on that device specifically, even if other devices are secure.

When you upgrade to a new phone or tablet, you will need to set up biometric login on the new device separately. The process is the same as the initial setup: you log in with your phone number and SMS code, enable biometric authentication in settings, and enroll your fingerprint or face. This creates a new device-binding key specific to the new device. The old device-binding key on your previous phone becomes useless once you no longer have that device or you remotely lock your account through Revolut’s security settings.

Remotely locking your account is essential if a device is lost or stolen. In Revolut’s app or through the web version (if available in your region), you can revoke all active sessions and device bindings. This immediately invalidates the device-binding keys on all devices, forcing any login attempts to use the full SMS and passcode verification process. Even if an attacker has your phone and your biometric, they cannot authenticate without the SMS code sent to your registered phone number or email. This remote lock feature should be one of the first actions you take if you realize your device is missing.

Another scenario to consider: what if you change your fingerprint or face due to injury, surgery, or age? You can re-enroll your biometric in Revolut at any time by going to security settings and selecting the option to update your biometric. The app will prompt you to present your new or updated fingerprint or face, and the device will create a new biometric profile for that device. Your old biometric profile is deleted locally. This process is device-specific, so updating your biometric on your phone does not affect your biometric setup on your tablet.

Security best practices for biometric login and account protection

Enabling biometric authentication on Revolut improves convenience, but it should not reduce your attention to overall device security. The most critical practice is keeping your device OS updated. Security patches for iOS and Android often address vulnerabilities in the Secure Enclave, Android Keystore, or biometric APIs. An outdated operating system can expose the biometric enrollment data or the device-binding key to attack, regardless of how secure Revolut’s biometric implementation is.

A second best practice is treating your passcode with the same care as a password. Do not write it down on paper stored in your wallet. Do not share it with family members or store it in a cloud note. Your passcode is a backup authentication method that should be known only to you. If someone learns both your passcode and gains access to your phone, they have a significantly easier path to your account. Consider using a different passcode for Revolut than for your phone’s PIN, so that someone who watches you unlock your phone cannot immediately access Revolut.

Third, regularly review your device list and active sessions in Revolut’s security settings. The app should show a list of devices where you are currently logged in. If you see a device you do not recognize, log out from that device immediately and consider changing your passcode. This is your early warning system for account compromise. Similarly, if you suspect that your phone number has been targeted for SIM swapping, contact your mobile carrier immediately and request a PIN to be added to your account, preventing SIM changes without your physical presence.

Fourth, use session timeouts to your advantage. Revolut will automatically log you out after a period of inactivity. For maximum security, set the shortest timeout your workflow permits. If you rarely check your account more than once daily, a 15-minute timeout is reasonable. A longer timeout like 4 hours is convenient but leaves a wider window during which a stolen phone could be misused. The trade-off is yours to make based on your risk tolerance and how often you actually access your account.

Fifth, consider using a hardware security key or two-factor authentication through an authenticator app if Revolut offers it in your region. Some financial institutions provide this additional layer beyond biometric and passcode. If available, it adds a third independent factor that an attacker would need to compromise. However, note that Revolut’s primary authentication factors are already quite strong; hardware keys are a meaningful but not always necessary upgrade for most users. For information about the full range of authentication options available to your account, visit the revolut login page to verify your region’s offerings.

Troubleshooting biometric login issues and recovery options

If biometric authentication stops working, the first troubleshooting step is to ensure that biometrics work elsewhere on your device. Go to your phone’s settings, test Face ID or fingerprint on a native app like Apple Pay or Google Pay, and confirm that the biometric hardware responds. If it does not, the problem is likely device-level, not Revolut-specific. Clean the sensor, restart your phone, or check for physical damage. If biometrics work on other apps but fail in Revolut, the issue may be with Revolut’s biometric integration or permissions.

On iOS, check Settings > Privacy > Face ID to confirm that Revolut has permission to use Face ID. On Android, check Settings > Apps > Permissions > Biometric to confirm that Revolut has biometric access. If permissions are missing, remove them and re-add them by toggling the biometric option in Revolut’s security settings. Sometimes, updating the Revolut app to the latest version resolves biometric inconsistencies, as the app developers may have patched compatibility issues.

If you are locked out of your account and cannot complete biometric authentication, your recovery path is the passcode. Enter your phone number, confirm the SMS or push code, and then enter your passcode instead of attempting biometrics. This should grant you access. Once logged in, go to security settings and check the status of your biometric enrollment. If it shows as inactive or corrupted, disable and re-enable biometric authentication to re-enroll your fingerprint or face. If re-enrollment fails repeatedly, your device’s biometric hardware may need service, or the Android Keystore or iOS Secure Enclave may need to be reset.

A final recovery option is contacting Revolut support. If you have lost access to your phone number, cannot receive SMS codes, or believe your account has been compromised, support can help you verify your identity and restore access. They may ask for your registered email, personal information, or recent transaction history to confirm that you are the account owner. This process can take time, which is why maintaining accurate contact information and a recent backup of your recovery options is important. Do not rely solely on biometric login as your only access method; always ensure you have a documented backup access path.