Revolut Login Caching & Browser History: Privacy & Security Risks on Shared Computers

A user logs into their Revolut account on a shared computer at work or in a library to check a balance or approve a payment. The login succeeds, the transaction completes, and they close the browser tab. Hours later, a colleague or stranger uses the same device and finds that the browser’s autofill feature pre-populates the phone number field with the user’s credentials, or that cached session data allows them to bypass the initial authentication screen entirely. The Revolut login process, while secure in isolation, becomes a liability when the device itself is not controlled exclusively by one person.

This scenario is not hypothetical. Browser caching, autofill databases, and temporary session storage create a persistent record of authentication attempts even after a user believes they have logged out. The risk multiplies on shared computers, public WiFi terminals, or borrowed devices where multiple people have physical access. Revolut’s security architecture—which includes device binding, multi-factor authentication via SMS codes, and biometric verification on the mobile app—protects against account takeover when the device is secure. But it assumes a baseline level of device isolation that often does not exist in shared-access environments.

How browser autofill and caching compromise Revolut login security

Modern web browsers store login information in a structured database designed for convenience. When a user enters their phone number on the Revolut web portal login page, the browser offers to save it. If accepted, that phone number is encrypted locally on the device and auto-filled on future visits to the same domain. This feature is useful on a personal device. On a shared computer, it becomes a foothold. A second user who opens the same browser and navigates to Revolut’s login page will see the stored phone number appear automatically, reducing the barrier to guessing or exploiting the account.

The browser also caches HTTP responses and session tokens in temporary storage. When a user successfully completes a Revolut login, the browser receives a session cookie or token that proves authentication to the server. That token is stored in RAM and sometimes written to disk in the browser’s cache directory. If a second user gains access before the token expires—or before the first user closes the browser completely—they may be able to reload a cached page and maintain access to the previous user’s session. This is especially dangerous if the second user knows the first user’s identity and can infer what actions they might take.

Device binding, a core Revolut security feature, does provide some mitigation. Device binding ties authentication to a specific device identifier, making it harder for someone to log in from a different device using stolen credentials. However, device binding protects against remote account takeover. On a shared device, the attacker does not need to log in remotely; they are already physically present. They can extract the cached session token while sitting at the same keyboard, or wait for the legitimate user to step away while still logged in.

The practical weakness is that browser security and device security are orthogonal. A browser on a locked device may still cache credentials visibly. A device with strong passwords may have a browser that auto-fills them for any site visitor. Revolut’s mobile app addresses this partly through biometric authentication and session timeouts that lock the app after inactivity. The web portal has no equivalent biometric option and relies entirely on the device’s operating system and browser to enforce access control.

Session timeouts and what “logged out” actually means

When a user taps “Log Out” in Revolut’s mobile app or closes the browser, most users assume they are fully logged out. The cryptographic truth is more complex. The app invalidates its local session token, and the server may mark the session as inactive. But the browser cache may still hold a copy of recently served pages. The operating system may retain memory artifacts. And if the user’s device is asleep rather than powered off, RAM is still powered and retains data in plaintext.

A session timeout is a server-side guard that automatically invalidates a session after a period of inactivity. Revolut implements automatic session timeouts on the mobile app as part of Revolut security best practice. The web portal also has timeout behavior, but the exact duration and the signals that trigger it (inactivity, explicit logout, app close) are not publicly detailed. A user who closes the browser tab but leaves the window open may not realize that the session remains active in another tab or window.

The visibility of “logged out” status varies significantly. On the mobile app, biometric authentication and passcode entry create a clear checkpoint. Users know they must unlock before accessing funds. On the web, the Revolut web portal login page may appear, but if the user is not forced through an explicit re-authentication, the browser may have cached an authenticated state that the user does not see. Browser developer tools can reveal what is stored. Most users do not open developer tools, so the cached state remains invisible.

For shared devices, the operational reality is that no timeout duration is safe. A user should not rely on automatic session expiry to protect their account if someone with physical access to the device can simply reopen the browser window, restore a cached page, or extract a session token before the timeout elapses. The timeout is one layer, but not a substitute for manual logout and cache clearing.

Physical access on shared computers creates a unique threat model

A shared computer at a workplace, school, internet café, or library operates under a different security model than a personal device. Multiple users have physical access in sequence, and sometimes simultaneously. Some users may have administrator privileges; others may not. Operating system-level access controls can be bypassed through USB devices, live operating systems, or exploitation of unpatched vulnerabilities. A user who logs in at a public terminal faces a Revolut login threat that goes beyond the application itself.

The most direct risk is that a second user simply opens the browser history or cache. Most browsers display a list of recently visited sites. If Revolut was accessed, the URL may be visible. Depending on browser settings, visiting that URL again may restore a cached page with the previous user’s session still active. Keyboard loggers—hardware devices placed between a keyboard and computer, or software installed by an administrator—can capture the phone number and passcode typed during Revolut login. Screen recording software running in the background can capture the entire process, including any SMS codes entered.

A malicious user with administrative access can install a proxy server, certificate authority, or man-in-the-middle tool that intercepts all browser traffic. This would require Revolut’s login endpoint to be unencrypted, which it is not (the Revolut web portal uses HTTPS), but an attacker with administrative control could still force the device to trust their certificate authority and inspect encrypted traffic. Device binding would help detect access from an unfamiliar device, but if the attacker is sitting at the original shared device, that defense is bypassed.

For these reasons, the security assumption underlying Revolut’s login design—that the device is reasonably secure and used by one person—breaks down entirely on a shared computer. No amount of SMS verification or anti-fraud scanning can protect an account if the attacker has physical access to the device at the moment the user is logged in, or if they can extract cached credentials or tokens that the browser has stored.

Multi-factor authentication and its limitations on shared devices

Revolut requires SMS-based multi-factor authentication for Revolut login on new or unrecognized devices. When a user attempts to log in from a browser not previously used, an SMS code is sent to their phone number. Without that code, the login cannot proceed. This is a genuine security improvement over a password-only system and protects against remote account takeover attempts using leaked credentials.

However, multi-factor authentication provides no protection against an attacker with physical access to both the shared computer and the user’s phone, or against an attacker who intercepts the SMS message. An employee at a company that provides corporate phones might find that those phones are in the same network or connected to the same management system as the shared computer, making SMS interception more plausible. A user who leaves their unlocked phone visible while logging in at a shared terminal has just defeated the second factor.

The biometric authentication available on Revolut’s mobile app—Face ID or fingerprint—is not available on the web. This is a significant gap. Biometric authentication would make it much harder for an attacker with only physical access to the shared computer to gain entry, since they would also need the user’s face or fingerprint. The web portal login could theoretically integrate biometric verification through WebAuthn, a modern standard for hardware and biometric authentication on the web, but Revolut has not adopted this approach.

SMS codes also have a practical timing vulnerability. If a user receives an SMS and reads it aloud while at a shared computer (“the code is 427389”), an eavesdropper or screen recorder has captured the second factor. If the user steps away briefly after reading the code but before entering it, an attacker at the keyboard can enter it themselves. For this reason, best practice is to receive the SMS on a separate device, read it privately, return to the secure location, and enter it in the narrow window before the code expires (typically five to ten minutes).

Best practices for Revolut login on shared or public devices

The first principle is to avoid login on shared devices whenever possible. If a user must check their Revolut account from a public computer, the mobile app is significantly safer than the web portal. Mobile apps benefit from the device’s biometric authentication, which is not available on the web, and from tighter integration with the operating system’s security features. The user should open the Revolut app (not a web browser), authenticate with Face ID or fingerprint, and complete the transaction or inquiry. Upon completion, the app should be closed completely, not just minimized.

If the web portal must be used, do so in a private or incognito browsing session. Most browsers offer a “Private Browsing,” “Incognito,” or “Private Window” mode that does not save history, cookies, autofill data, or cache to disk. Opening the Revolut web portal login page in an incognito window prevents the browser from storing the phone number, session token, or browsing history. Upon closing the incognito window, all cached data is deleted from the device. This is not perfect—an attacker with administrative access could still monitor network traffic or use a keylogger—but it eliminates the persistent browser-level footprint.

Do not allow the browser to save the phone number or password when prompted. When a login form appears on the Revolut web portal, the browser will offer to save credentials. Decline explicitly by clicking “Not Now” or “Never.” If credentials are already saved, manually delete them from the browser’s password manager before leaving the computer. Most browsers allow deletion through settings → passwords → manage saved passwords.

Always explicitly log out. Do not close the browser tab or window assuming the session has ended. Click the account menu and select “Log Out” if available, or use the browser’s developer tools to delete cookies for the Revolut domain. Close all browser windows before leaving the device. Some browsers allow closing all windows with a single command (usually File → Close All or Cmd+Q on macOS); use this rather than closing tabs individually.

Clear the browser cache before leaving. Open the browser’s settings, navigate to Privacy or History, and select “Clear Browsing Data” or “Clear Cache.” Ensure the time range covers at least the past hour, and select “Cookies and Cached Images” as the data types to delete. This removes the session token and any pages cached during the session. If the browser history itself is visible, delete it as well.

Request a device logout from Revolut’s settings if the feature is available. Some fintech apps allow users to remotely log out all active sessions from the account settings page. This invalidates all session tokens across all devices and browsers, preventing a cached session on a public computer from remaining valid. Check Revolut’s account security or settings page to see if this option exists.

What Revolut’s design could improve for shared-device security

The most impactful change would be adding biometric or hardware authentication to the web portal. WebAuthn support would allow users to authenticate using a hardware security key (FIDO2) or device biometric (if the browser and operating system support it). This would require a second factor that cannot be cached or guessed, and would make shared-device attacks dramatically harder. Users would still need to clear cookies and history, but the authentication layer itself would be much stronger.

A configurable session timeout would also help. If Revolut allowed users to set an aggressive timeout for their account—logging out after 5 or 10 minutes of inactivity—shared-device risk would decrease. A user who steps away and forgets to log out manually would be logged out automatically. This is a trade-off for convenience (the user would need to re-authenticate more often), but for high-risk accounts or users on shared devices, the option should exist.

Revolut could display the device login history more prominently and allow users to see and remotely log out sessions from specific browsers or locations. If a user logs in from the office at 10am and later sees a second login from the same IP address at 3pm, they could recognize it as potentially fraudulent and immediately log out that session. This feature exists on many online banking platforms and would give users visibility into whether their account was accessed while they were away.

Clear labeling of what data is cached would improve user awareness. The Revolut web portal could display a warning after login on a shared device: “This device will retain your session information in the browser cache. Clear cache and cookies before leaving.” This would not prevent the security issue, but it would make users aware of the risk and more likely to clear data before departing.

Why device binding alone is insufficient for shared computers

Device binding is one of Revolut’s strongest Revolut security features for typical use. It ties an account to a specific device by recording a hardware identifier or certificate during the initial login from that device. When the same account logs in later, Revolut verifies that the login is coming from the same device. If a login attempt comes from a different device or browser, additional verification steps (such as SMS codes) are triggered. This makes it much harder for someone who has stolen credentials to log in remotely from their own computer.

However, device binding protects only against remote attacks. If an attacker has physical access to the bound device and the user is already logged in, device binding does nothing. The attacker sits at the same keyboard, and the device is recognized. The session is active, and they can use it immediately. Similarly, if an attacker extracts a session token or cached credential while sitting at the device, they can use it immediately without triggering the device-binding verification because the token already proves the authentication was performed on an authorized device.

The assumption underlying device binding is that physical access to the device is controlled—that if you are using the device, you are the account owner. This assumption breaks down completely on a shared computer. A Revolut login from the shared computer cannot distinguish between the account owner and a colleague or stranger with access to the same machine. All they see is a login from an authorized device, so additional verification steps do not trigger.

For shared-device security, the user must implement controls that device binding cannot provide: clearing credentials, logging out explicitly, and avoiding login when not absolutely necessary. Device binding remains valuable for protecting against remote account takeover and for devices where only one person has access. But it is one layer of a multi-layered defense, and it cannot be the only layer.