Session Timeout in Revolut: How Long Can You Stay Logged In?

Revolut users managing multiple currencies, investment positions, and international transfers often leave the app open for extended periods, particularly when traveling or handling cross-border payments. The question of how long an active session persists—and what triggers an automatic logout—matters both for convenience and security. A timeout that is too aggressive can force repeated authentication, while one that is too lenient can expose an unlocked device to unauthorized access. Understanding Revolut’s session management policy is therefore essential for both active traders using the platform’s stock and crypto features and ordinary users making everyday payments across 120+ countries.

Revolut’s approach to session timeout reflects the tension between usability and security. The app uses phone number-based authentication combined with SMS or push codes, biometric verification, and device binding rather than traditional static passwords. When a Revolut login session expires, the user must re-authenticate, but the exact timeout duration and the conditions that trigger it remain less transparent than they should be. This article examines what Revolut’s session management actually does, how inactivity timeouts work in practice, what happens during a forced logout, and how users can balance security with the reality of frequent app usage.

The standard Revolut login and session lifecycle

When a user first opens the Revolut app after installation or a complete logout, they are prompted to enter their phone number. This initiates a verification flow where Revolut sends either an SMS code or a push notification to a registered device. The user then enters a 4–6 digit passcode and, if enabled, completes biometric authentication using Face ID or fingerprint. This multi-factor approach means that even if a phone number is intercepted, a single factor is insufficient to gain access. The Revolut login process is designed to tie authentication not just to the user but to the specific device being used.

Once authentication succeeds, Revolut creates a session token on the device and binds it to the hardware identifiers of that specific phone or tablet. This device binding mechanism means that the same credentials cannot be used to log in on a different device without re-authenticating from scratch. The session remains active as long as the user continues to interact with the app and the device remains unlocked and connected to the internet. During an active session, the user can view balances, initiate transfers, approve payments, and access investment features without needing to re-enter their passcode.

The exact duration of an active Revolut login session before automatic timeout is not publicly detailed in Revolut’s standard documentation, but evidence from user reports and app behavior suggests sessions typically remain valid for periods ranging from 15 to 30 minutes of complete inactivity. However, this timeout window is not fixed across all account types, transaction types, or security contexts. A user transferring a large sum internationally may face re-authentication sooner than one simply checking balances. Similarly, sessions may persist longer on devices with established security histories than on newly added devices.

What makes this behavior significant is that Revolut’s session timeout is not purely time-based. It is also tied to specific high-risk actions. Any attempt to change critical account settings—such as adding a new beneficiary for international transfers, modifying card spending limits, enabling cryptocurrency trading, or changing the registered phone number—will trigger a re-authentication requirement regardless of how recently the user authenticated. This means that even within an active session, Revolut security policies enforce additional verification barriers for sensitive operations.

Inactivity timeout and what triggers automatic logout

The most common reason for an automatic session timeout is device inactivity. Once the user stops interacting with the app—no taps, swipes, or screen touches for a defined period—Revolut’s session manager counts down to termination. The inactivity clock typically resets each time the user performs an action within the app. Viewing a transaction, checking a balance, scrolling through the investment portfolio, or approving a payment all signal active use and refresh the timeout timer. However, passive activities such as receiving a push notification or having the app run in the background do not necessarily extend the session.

A second trigger for session termination is explicit user action. Users can manually log out by navigating to account settings and selecting a logout option, which immediately invalidates the current session token and requires full re-authentication on the next Revolut login attempt. This is distinct from merely closing the app, which suspends the session but does not necessarily destroy it. If a user closes Revolut and reopens it within the session window, biometric authentication or a quick passcode entry may be sufficient to restore access without repeating the full phone number verification flow.

Revolut also terminates sessions automatically in response to security events. If the app detects unusual activity patterns—such as a login attempt from an unexpected geographic location, a sudden spike in transaction volume, or multiple failed authentication attempts—it may force a logout as a protective measure. Additionally, if a user disables or changes their device’s biometric settings, adjusts the registered phone number, or removes the device from Revolut’s trusted device list, the current session expires and re-authentication becomes mandatory. These security-driven logouts are designed to prevent unauthorized access if the device itself may have been compromised.

Another less obvious scenario involves token refresh and API session management. Behind the scenes, Revolut’s servers issue time-limited authorization tokens that the mobile app uses to authenticate API requests. These tokens are typically valid for a defined window—often ranging from 15 minutes to several hours depending on the request type—and must be periodically refreshed. If the device loses internet connectivity, the app may not be able to refresh the token silently in the background. When the user returns to the app after a connectivity gap, they may need to re-authenticate even if the session technically expired while the device was offline.

Re-authentication requirements for sensitive transactions

Revolut’s security architecture distinguishes between low-risk actions and high-risk actions. Low-risk actions include viewing balances, checking transaction history, viewing current exchange rates, and browsing the investment marketplace. These can generally be performed without additional authentication once an initial Revolut login has succeeded. High-risk actions trigger mandatory re-authentication regardless of session state. Initiating an international transfer above a certain threshold amount, adding a new payment beneficiary, enabling or disabling trading features, changing spending limits, or requesting a new physical card all require the user to re-enter their passcode or complete biometric authentication again.

The threshold amounts and specific risk classifications are not publicly detailed, meaning users often encounter re-authentication unexpectedly when they reach certain transaction sizes or attempt unfamiliar operations. This design reflects a principle in fintech security: Revolut authentication should scale with exposure. A small domestic payment in a frequent currency pair may proceed with minimal friction, while a large international transfer to a newly added beneficiary in a high-risk jurisdiction may require multiple verification steps. The inconvenience of re-authentication is intentional, designed to ensure that if a device has been compromised or left unlocked in public, an attacker cannot instantly drain accounts or change fundamental settings.

One important distinction is between session re-authentication and transaction confirmation. Even after successfully re-authenticating for a high-risk action, the user may still need to confirm the specific transaction details. For example, when initiating an international transfer, Revolut will display the recipient account, amount, currency, fees, and expected delivery time. The user must explicitly confirm each detail is correct before the transfer proceeds. This two-stage verification—re-authentication plus explicit confirmation—means that automatic logout policies do not eliminate the need for user awareness during sensitive operations.

How session timeout varies across device types and regions

Revolut’s regional licensing structure—operating through Revolut Ltd in the UK, Revolut Bank UAB in the EU, with separate entities serving the US, India, and Mexico—can create subtle variations in session management. While the core authentication mechanism is consistent, the specific timeout policies, re-authentication triggers, and session duration thresholds may differ based on local regulatory requirements. European users, who operate under PSD2 (Payment Services Directive 2) and Strong Customer Authentication (SCA) requirements, may experience more frequent re-authentication prompts than users in jurisdictions with less prescriptive regulation.

Device type also influences session behavior. Users accessing Revolut on a primary personal smartphone with established history and no suspicious login attempts may enjoy longer session windows than those on newly added devices, shared tablets, or devices with frequent location changes. Similarly, devices registered with hardware-backed security features—such as Apple’s Secure Enclave on iPhones or Android’s Trusted Execution Environment (TEE) on supported devices—may allow slightly longer sessions because the device itself provides additional security assurance to Revolut’s backend systems.

The version of the Revolut app itself can matter. Users running outdated versions of the application may experience different session management behavior than those on the latest release, simply because security policies evolve over time and the backend systems may enforce different rules based on detected app versions. If Revolut detects that a user is running an old version, it may impose stricter session requirements or force more frequent re-authentication as a compensating control. Users who do not keep the app updated therefore not only miss security patches but may inadvertently trigger more frequent logouts.

Manual session management and logged-in device viewing

Revolut provides users with limited visibility into active sessions. Within the app’s settings, users can typically view a list of devices that have active Revolut login sessions. This feature shows device names, types (iPhone, Android, etc.), approximate locations based on last activity, and the date the device was last used. Users can manually terminate sessions on specific devices by selecting a device and choosing „log out“ or „remove device.“ This capability is valuable for users who suspect a device has been compromised or who have sold or given away a phone and want to ensure it cannot be used to access their account.

Manually terminating a session on a remote device forces that device to re-authenticate before any further app activity is possible. This can be useful if a user loses a phone, shares a device with someone else, or uses a computer tablet that they no longer trust. The process is instantaneous on Revolut’s backend, though the affected device will not be notified of the session termination until it next attempts an action requiring API communication. If a device is offline, the session termination takes effect when the device reconnects.

However, this manual session management feature underscores the importance of regularly reviewing active devices and sessions. Users who have enabled the Revolut app on multiple phones over time—due to device upgrades, testing, or family members using devices—may accumulate sessions without realizing it. Each additional active session represents a potential vector for compromise. Periodically auditing the active device list and removing unknown or unused devices is a practical security hygiene practice that complements automatic session timeouts.

The relationship between session timeout and biometric locks

Revolut’s session timeout interacts with device-level biometric and PIN protections in ways that are not always obvious. If a user has configured Face ID or fingerprint authentication on their device and enabled biometric unlock in Revolut, a session timeout does not necessarily require the full revolut login flow with phone number and SMS code. Instead, the app may drop back to a biometric prompt. This intermediate state—authenticated to the device but not fully authenticated to Revolut’s servers—allows faster re-entry while still requiring user action and biometric verification.

This design choice reflects a practical security model: the primary risk is that an unlocked device left unattended will be accessed by a nearby person who does not know the passcode. Biometric authentication protects against that casual access. However, if a device’s biometric data has been compromised (such as through spoofing or if the device was stolen and biometrics were disabled), the session timeout clock may be reset by someone who should not have access. Users should therefore not view biometric re-authentication as equivalent to full account re-authentication and should remain cautious about leaving the app open on a device in unsecured environments.

The device-level PIN or passcode also matters. If a device’s screen lock PIN is weak or nonexistent, an attacker who gains physical access can potentially bypass both the device-level lock and Revolut’s biometric prompt, reaching an authenticated session without triggering account-level authentication. For users holding significant balances or conducting frequent international transfers, enabling a strong device-level PIN is therefore a prerequisite that often matters more than Revolut’s own biometric settings.

Best practices for session security and convenience

Users seeking to balance security with convenience should begin by understanding their own usage pattern. If the user frequently keeps Revolut open while multitasking, switching between apps, or placing the phone down without closing the app, a shorter automatic timeout is safer. Conversely, if the user is actively trading stocks or managing cryptocurrency positions throughout the day, frequent re-authentication becomes a genuine friction point. Revolut does not typically offer user-configurable session timeout settings, so users cannot manually adjust the threshold; however, awareness of the default behavior allows users to adapt their practices.

A practical habit is to explicitly log out when leaving the app in situations where the device may be exposed to others—such as in a public place, at work, or before handing the phone to someone else for any reason. Explicit logout via the settings menu ensures that the session is immediately invalidated rather than relying on the timeout clock. This takes only a few seconds and provides certain protection, whereas relying on an automatic timeout introduces uncertainty about the exact termination time.

Users should also treat Revolut security as layered. Session management is one control; device-level security is another. A strong device PIN, regular biometric configuration review, and avoiding public WiFi for sensitive transactions form the outer layer. Within that context, Revolut’s automatic session timeout and re-authentication requirements for sensitive actions provide an additional barrier. None of these layers alone is sufficient, but in combination they significantly raise the cost of unauthorized access.

Regularly reviewing active sessions—particularly after major device changes, app reinstalls, or if a device is suspected to be compromised—is a habit worth developing. Revolut makes this straightforward through the settings menu. Taking a minute to verify that only expected devices have active sessions costs nothing and can catch unauthorized access before it becomes a problem. If an unfamiliar device appears in the list, immediate session termination and a password reset or additional security review should follow.