How to cut KYC risks after threats to Revolut

Attackers recently threatened to access or publish Revolut customer information, prompting Revolut to open an investigation while security teams review potential exposure. The alerts focus attention on the identity documents and verification records that fintech firms collect during onboarding.

Know Your Customer (KYC) records typically include passport or ID images, selfies for facial checks, and proof-of-address documents. Those files and related metadata can be used for fraud, identity theft or extortion if an attacker gains access to them.

Customers can reduce personal KYC risk by following secure submission and account hygiene practices. Use only the official app or website to upload identity documents and confirm any re‑request inside the app before sending more files. Do not send passport or ID photos by email or messaging apps. Enable multi-factor authentication, choose strong unique passwords, and enable biometric locks where available. Keep phones and apps updated, turn on push notifications for account activity, and check transaction and login history for unfamiliar actions. Avoid storing high-resolution ID images on unencrypted cloud services or devices; consider a separate email address for financial accounts that is not publicly linked to social profiles.

Financial firms can reduce exposure through technical controls and changes to data handling. Keep only the minimum customer data required, and set retention schedules to delete unneeded files. Encrypt identity documents both in transit and at rest, remove plain-text identifiers where possible and use tokenization for stored identifiers. Apply strict role-based access controls, keep detailed audit logs and monitor privileged accounts for unusual activity.

Automated verification and continuous monitoring can detect forged or synthetic identities during onboarding and after account activation. Liveness checks, two-step verification for high-risk changes, device fingerprinting and behavioral analytics help flag accounts that merit further review. Regular third-party security assessments, penetration tests and secure code reviews can reveal vulnerabilities in systems that collect KYC materials.

Supplier security is part of the risk picture. Firms that use third-party providers for document scanning, identity checks or cloud storage should perform vendor due diligence, require contractual security controls and set incident-notification timelines. Maintain an incident response plan and run tabletop exercises to test roles and response times.

Some firms use privacy-preserving identity methods, such as hashing, selective disclosure or privacy-enhancing identity frameworks, to verify attributes without storing full document copies. Where allowed by law, relying on certified verification providers or shared KYC utilities can reduce duplicate data storage. Anti-money laundering rules and local data protection laws still require certain records; firms should document how they meet regulatory obligations while limiting data exposure.

Attackers target KYC material because documents can be sold or reused to open accounts and commit fraud. Fintechs that onboard many customers quickly may receive large volumes of identity data in short windows, which can increase operational strain on manual review processes.