Digital onboarding continues to create significant friction for customers of major fintech platforms, including the robo-advisor Betterment and the banking app Revolut.
Recent incidents and user experiences illustrate tensions between regulatory compliance requirements, data security, and the practical convenience of opening accounts online.
In September 2026, Revolut customers encountered two separate third-party data issues within weeks of each other.
One involved DriveWealth, the US brokerage firm that previously supported Revolut’s U.S. stock trading feature.
DriveWealth reported that an unauthorized party gained access to its systems on September 4 and 5 through social engineering.
The exposed information related to historical records for certain customers who had used the service before Revolut shifted its trading model (between late 2023 and mid-2025, depending on the market).
Categories of data that may have been affected included names, email addresses, phone numbers, postal addresses, employment details, country of citizenship, age, gender, and partial account numbers.
Revolut stated that its own systems, funds, passwords, and identity documents were not compromised in this incident, and that individual personal details from more recent periods in markets such as the UK, EEA, and Australia were not shared with DriveWealth.
Earlier that month, Revolut disclosed sensitive customer information after receiving fraudulent requests that appeared to come from a legitimate Italian government email domain via the country’s certified email system.
The requests, which the company treated as authentic, resulted in the release of data for roughly 680 customers—reportedly targeting higher-net-worth individuals with cryptocurrency activity.
The information included copies of passports or driver’s licenses, verification selfies, addresses, contact details, bank statements, and transaction histories (including Bitcoin activity).
Revolut’s core systems were not breached; the company had responded to what it believed were official inquiries before identifying the issue, blocking the address, and notifying regulators and the relevant agency.
Italian authorities launched investigations into the compromised government email.
Hackers later demanded a multimillion-dollar ransom, and Revolut indicated it would assist affected customers with costs related to replacing identity documents.
These events occurred against a backdrop of other challenges for Revolut, including elevated volumes of fraud and scam complaints escalated to the UK Financial Ombudsman Service compared with other providers, as well as a fine of more than €11 million from Italy’s competition authority in April 2026 related to unfair commercial practices concerning investment disclosures and other banking information.
Betterment, which experienced its own social-engineering incident in January 2026 that allowed an unauthorized party to access certain third-party marketing and operations tools and contact information for a large number of customers (without compromising accounts or credentials), has drawn recent user complaints about its digital onboarding process.
Although Betterment partners with Socure for know-your-customer (KYC) verification—an arrangement the companies have described as improving auto-approval rates—some users report being asked to submit extensive documentation.
This can include images of passports or state-issued IDs, Social Security cards, bank statements or other proof of address, and selfies paired with official identification.
Official Betterment guidance confirms that Social Security numbers (or alternatives such as ITINs) and identity documents are collected to meet KYC, anti-money-laundering, and tax-reporting obligations, with additional uploads requested when automated checks are insufficient.
Recent public comments have described the sequence as particularly cumbersome, with account suspensions or delays occurring after initial identity steps.Revolut relies on Onfido for aspects of its identity verification.
While Onfido is also used by platforms such as eToro (for example, in biometric features for account recovery), user reports and review platforms have noted technical difficulties and rejections with Revolut’s implementation, including failed document scans or liveness checks that can prevent legitimate applicants from completing account opening.
Both companies maintain that these processes are necessary for regulatory compliance and fraud prevention.
In the United States, Senator Cynthia Lummis has engaged with related regulatory questions through work on digital-asset legislation such as the CLARITY Act.
Discussions have addressed Bank Secrecy Act obligations, customer due diligence standards for certain platforms, and the need for clearer boundaries so that compliance measures do not impose disproportionate burdens on innovation or non-custodial activities. These developments underscore an ongoing need to balance robust identity verification with user privacy, data security, and a smoother experience that does not deter legitimate customers.