Revolut ID Thefts: The KYC Problem Nobody Wants to Fix

Emily Wilson · 2026-09-16

Imagine handing your passport to a stranger every time you wanted to buy a stock or send crypto. That's basically what KYC—Know Your Customer—requires. And when companies like Revolut get hit by ID theft, your most sensitive documents end up in the wrong hands. So why are we still doing it this way? ### What Actually Happened with Revolut Revolut, a popular fintech app with millions of users, recently disclosed a data breach. Cybercriminals accessed personal information, including ID documents, for a small percentage of customers. For those affected, it's a nightmare: potential identity theft, financial fraud, and months of cleanup. But here's the kicker: this isn't a Revolut-specific problem. It's a systemic flaw in how we verify identities online. Every platform that stores your driver's license or passport becomes a juicy target. ### Why KYC Exists (and Why It's Broken) Governments require financial institutions to verify who you are. The goal is to prevent money laundering, terrorist financing, and fraud. Noble, right? The problem is the implementation. Most companies collect and store copies of your ID documents indefinitely. That creates a massive honeypot. > "The safest data is data you never store in the first place." — Unknown security expert So we're stuck in a cycle: verify, store, get breached, repeat. Meanwhile, you're the one left dealing with the fallout. ### The Zero-Knowledge Solution Zero-knowledge proofs (ZKPs) offer a way out. Here's the simple version: instead of handing over your actual ID, you could prove you're over 18, live in the US, and have a clean record—without revealing your name, address, or birthdate. Think of it like proving you know a secret without saying the secret out loud. Cryptographers have been working on this for decades, and it's finally practical. ### Why Isn't This Standard Yet? Good question. A few reasons: - **Legacy systems**: Banks and regulators move slowly. Rewriting compliance rules takes years. - **Cost**: Implementing ZK tech isn't cheap, though it's getting better. - **Fear of the unknown**: Regulators like seeing paper trails. Zero-knowledge feels like a black box. - **Lobbying**: Companies that profit from data collection have little incentive to change. But the tide is turning. Projects like Polygon ID and zkSync are already testing decentralized identity. The EU's eIDAS 2.0 regulation is pushing for digital identity wallets. Change is coming—just not fast enough. ### What You Can Do Right Now Until zero-knowledge becomes mainstream, protect yourself: - Use a password manager and enable 2FA everywhere. - Avoid uploading IDs to platforms you don't absolutely trust. - Consider using a virtual phone number and email alias for sign-ups. - Monitor your credit reports for suspicious activity. - If a breach happens, freeze your credit immediately. ### The Bottom Line Revolut's breach is a wake-up call. KYC isn't going away, but it doesn't have to be a privacy disaster. Zero-knowledge tech offers a real fix—if companies and regulators get on board. Until then, stay vigilant. Your identity is worth more than a convenient login.