A user with ADHD or autism who has successfully managed finances through Revolut for months suddenly encounters friction during what should be a routine transaction. The authentication sequence—phone number entry, SMS code retrieval, passcode input, and biometric verification—requires sequential attention, short-term memory, sensory processing, and rapid context-switching. For some neurodivergent users, this layered security creates a cumulative cognitive load that transforms a five-second login into a five-minute ordeal involving failed attempts, stress responses, and potential account lockouts. The issue is not that these security measures are unnecessary; it is that their design assumes a specific cognitive and sensory profile that not all users share.
Revolut’s global footprint of over 70 million users includes a substantial population with autism, ADHD, dyslexia, anxiety disorders, and other conditions that affect attention, memory, sensory processing, or executive function. The app’s Revolut login mechanism prioritizes security—a legitimate priority—but does so through a sequence that disadvantages users whose brains process information differently. Understanding where that friction occurs, why it matters, and what accessibility improvements might help without undermining security is essential for both users navigating the system and the platform itself as it scales to serve more diverse populations.
The cognitive architecture of Revolut’s multi-step authentication
Revolut’s security design separates authentication into discrete stages: phone number submission, SMS code retrieval and entry, a 4–6 digit passcode, and optional biometric verification through Face ID or fingerprint. This layering is defensible from a security perspective. Requiring something you know (phone number and passcode), something you receive (SMS), and something you are (biometrics) distributes the attack surface across multiple channels and reduces the risk that a single compromised credential will unlock the account. However, the sequence creates cognitive demands that accumulate rather than add sequentially.
First, the user must recall or locate their phone number accurately. For someone with working memory limitations or number sequencing difficulties, this single step can require external reference—consulting a document, checking a backup email, or retrieving a stored note. ADHD users often report that numeric sequences feel less “sticky” in memory than words; the cognitive effort to retain a 10–12 digit phone number while typing it into a field can be disproportionate. Once submitted, the user must then wait for an SMS to arrive, which introduces a timing demand. Network delays, notification settings, or phone orientation can obscure the message. The user must then extract the code, hold it in working memory, return to the Revolut app, and enter it correctly before any timeout.
The passcode follows the same pattern: retrieval, entry, verification. For a 4–digit passcode, digit transposition errors (entering 1234 as 1243) are common, particularly under time pressure or in noisy environments. A user with dyspraxia or fine-motor coordination challenges may also struggle with touchscreen accuracy, requiring multiple attempts. Each failed attempt carries psychological weight—a sense that the system is rejecting the user—and may trigger anxiety or executive dysfunction that further impairs the ability to recall or enter information accurately. By the time biometric login options are reached, the user may already be frustrated or cognitively depleted.
The design also assumes consistent device behavior. If Face ID fails because the device’s angle is wrong, the lighting is poor, or the user’s appearance has changed (wearing glasses, a hat, or having a different hairstyle), the user must fall back to the passcode sequence again. For an autistic user with visual processing differences or someone with ADHD who has already burned through their executive function budget for the day, this reset is not merely inconvenient—it is a point where many users abandon the attempt and either defer their transaction or switch to a different service.
Working memory and number sequences under pressure
Working memory—the capacity to hold and manipulate information briefly—is often impaired in ADHD and can be unpredictable in autism depending on the individual and the context. SMS codes are typically six digits. A neurotypical user may glance at the message, hold it in mind while switching apps, and enter it without conscious effort. An ADHD user may read the code, switch to the Revolut app, find that the code has slipped from memory, and must return to the message. Each cycle consumes cognitive resources and increases the likelihood of transcription error.
The pressure compounds because SMS codes are time-limited, often expiring within five or ten minutes. For a user with slower processing speed, executive function challenges, or sensory sensitivities that make rapid task-switching difficult, this artificial deadline creates stress. Stress impairs cognitive performance further, creating a feedback loop where the time limit itself becomes the primary barrier rather than security itself. A user with anxiety may become so focused on the ticking clock that they misread the code or enter it incorrectly, triggering another SMS request and deepening frustration.
Password managers and SMS forwarding apps can help, but they introduce their own friction. A user must trust a third-party app with authentication codes, which some security-conscious individuals resist, and setting up the automation requires attention to detail that may not be available during periods of executive dysfunction. Additionally, not all users have the technical literacy or environmental stability to maintain and access these tools consistently.
Sensory and motor barriers to biometric verification
Face ID and fingerprint authentication are often presented as more accessible than passwords because they eliminate the need to recall or type information. For many users, this is genuinely true. For others, biometric systems introduce sensory and motor challenges. Face ID requires the user to align their face within a specific frame, hold still briefly, and tolerate the proximity and camera behavior. Users with autism may experience discomfort with face-to-device proximity, sensory sensitivities to light from the camera, or difficulty interpreting the system’s success or failure feedback. Some autistic users report that the directional requirements of Face ID trigger proprioceptive or vestibular dysregulation.
Fingerprint authentication requires sufficient skin moisture, oil, and texture for the sensor to register a clear print. Users with certain skin conditions, those who work with their hands in ways that degrade fingerprints, or individuals with sensory sensitivities to touch may find the sensor unreliable. An ADHD user may forget to hold their finger steady, resulting in repeated failed attempts. Each failure forces a return to the passcode backup, reactivating the memory and timing demands.
The biometric interface also lacks granularity. A user cannot explain to Face ID why it failed; the system simply rejects the attempt and, after a few failures, locks the user out or forces them back to traditional authentication. This opacity frustrates neurodivergent users who benefit from explicit, detailed feedback about what went wrong and what to do differently.
Account lockout and recovery friction under stress
Repeated authentication failures lock the account temporarily or require the user to verify through an alternative method. For a user already stressed by failed attempts, the prospect of account lockout can trigger anxiety or panic, further impairing their ability to think clearly. The recovery process—often involving sending support messages, waiting for response, or re-verifying identity—places the user in a dependent position that many neurodivergent people find psychologically costly.
Autistic users, in particular, often experience communication-related stress when requiring assistance from support systems. The process of explaining a problem, waiting for help, and following instructions from another person can feel threatening or emotionally demanding. An account lockout that forces this interaction, rather than offering a self-service path back to access, removes user agency and increases the likelihood that the person will abandon the platform or experience lasting negative emotions associated with the app.
ADHD users, by contrast, often struggle with the delay and uncertainty inherent in support-based recovery. The possibility that a response may take hours or days activates their time-sensitivity and can trigger procrastination patterns, where the user postpones contacting support and the problem compounds. A frictionless self-recovery mechanism—such as confirming identity through linked email or a backup phone number—would reduce both the immediate anxiety and the barriers to resolution.
Time-of-day and state-dependent authentication difficulty
Cognitive performance in ADHD and autism is often state-dependent, varying throughout the day and in response to stress, sleep, food, sensory environment, and other factors. A user who successfully logged in at 9 a.m. may find the exact same authentication sequence insurmountable at 6 p.m., not because they forgot their credentials but because their executive function and working memory have degraded. The Revolut app does not know this. It applies the same authentication standard regardless of whether the user is well-rested or exhausted, in a calm environment or a chaotic one, medicated or unmedicated.
This state-dependency creates a hidden accessibility barrier. A user may successfully use Revolut for weeks, then suddenly encounter what feels like a new obstacle when their cognitive state changes. They may blame themselves—assuming they misremembered their passcode—rather than recognizing that the challenge is contextual and not a permanent deficit. This self-blame compounds stress and can lead to reduced app engagement or account abandonment.
Biometric login can, paradoxically, worsen this problem because it may encourage the user to forgo memorization of their passcode. If the user has become dependent on Face ID and suddenly the biometric fails due to a change in appearance, lighting, or device calibration, they must fall back to a passcode they no longer holds firmly in memory. The seeming convenience of biometric login has become a trap.
Designing authentication for cognitive accessibility
Improved accessibility does not require abandoning security. Several design changes could reduce cognitive and sensory friction while maintaining protection. First, allowing users to enable persistent login on trusted devices—with explicit re-authentication required only for sensitive actions like changing payment settings—would eliminate the need for authentication on every session. Security can be maintained through device binding and account activity monitoring rather than requiring the user to prove their identity repeatedly.
Second, Revolut could offer a revolut login option that uses email verification alongside or instead of SMS codes. Email messages remain visible and retrievable if the user needs to reference the code multiple times; SMS messages often disappear into the notification history. This change would particularly help users with working memory challenges.
Third, passkeys—cryptographic credentials stored securely on the device that do not require the user to remember or enter any code—offer a middle ground. A passkey requires biometric or PIN confirmation on the device but eliminates the SMS and passcode sequence entirely. For users who can reliably use biometric or PIN authentication, this simplification removes significant friction. Apple, Google, and other platforms are moving toward passkeys as a security standard, and Revolut’s implementation of this approach would align with industry best practice.
Fourth, the app should offer configurable timeouts for SMS codes and passcodes, allowing users with slower processing speed to request extended windows without triggering additional security alerts. Extended timeouts could be granted only to users who have previously verified additional identity information, maintaining security while increasing usability.
User strategies and workarounds within current constraints
While awaiting platform-level improvements, users with cognitive accessibility needs can implement several strategies. Storing phone numbers and passcodes in a password manager—such as Bitwarden, 1Password, or iCloud Keychain—reduces the memory load. When logging in, the user can autofill the phone number from the manager, and many managers can also retrieve and copy the passcode without exposing it on screen. This does not violate security; it shifts the burden from human memory to encrypted digital storage.
Enabling biometric authentication and testing it in calm, well-lit conditions helps the user understand its reliability and limitations. If biometrics frequently fail, a user should either practice the specific technique required by the device or consider biometrics unreliable in their situation and rely primarily on the passcode backup.
Setting up SMS forwarding to an email account (available on some carriers) ensures that authentication codes remain retrievable even if they scroll out of the notification history. Some email clients also support shortcuts or rules to highlight security-related messages, making them easier to locate under time pressure.
Finally, users should reach out to Revolut’s accessibility team with specific descriptions of where the Revolut login process creates barriers for them. Platforms respond to documented user needs; individual requests to customer support, while valuable, are less likely to influence product design than structured accessibility feedback submitted through official channels.
The broader accessibility imperative for fintech
Revolut’s rapid growth and global scale have made it a primary financial gateway for millions of users, including many who are neurodivergent. The stakes are not abstract: authentication barriers can lock people out of their own money, prevent them from paying bills, disrupt financial management routines, and force them to maintain relationships with less accessible traditional banks. For users who have chosen Revolut precisely because its app-based design feels more navigable than physical banking or other platforms, accessibility regressions are particularly damaging.
The responsibility to address these barriers is not solely Revolut’s. Broader fintech industry standards around authentication, combined with regulatory expectations—such as those embedded in accessibility laws in the EU, UK, and US—create an environment where companies are increasingly expected to offer accessible authentication. Regulators and advocacy organizations are also beginning to scrutinize whether multi-factor authentication requirements, while legitimate for security, are implemented in ways that inadvertently exclude people with disabilities.
Users navigating the current Revolut app should understand that friction during authentication is not always a personal failure. The system design itself may be incompatible with their cognitive or sensory profile. Recognition of that mismatch—rather than self-blame—is the first step toward either adapting the user’s strategy or deciding that a different platform would serve their needs better. For Revolut and other fintech platforms, the recognition that one authentication method does not fit all users is the foundation for designing systems that are secure, usable, and genuinely inclusive.
Frequently asked questions
Why does Revolut login require so many steps?
Revolut’s multi-step authentication—phone number, SMS code, passcode, and biometric—separates verification across multiple channels and credential types to reduce the risk that a single compromised credential will expose the account. This layering improves security, but the sequence creates cumulative cognitive and sensory demands that disadvantage some users, particularly those with ADHD, autism, or working memory challenges.
Can I disable some authentication steps to make Revolut login faster?
Revolut’s current design requires the full authentication sequence for security reasons. However, users can enable biometric authentication and use password managers to autofill phone numbers and passcodes, reducing memory burden. Enabling persistent login on trusted devices—if Revolut offers this feature—eliminates the need to re-authenticate frequently. Check your account settings to see what options are available in your region.
What should I do if Face ID or fingerprint authentication keeps failing?
Biometric authentication can fail due to poor lighting, incorrect device positioning, sensory sensitivities, or skin conditions. Test biometrics in calm, well-lit conditions to understand their reliability for you. If they consistently fail, rely on your passcode as the primary method. You can also contact Revolut support to report accessibility barriers and request that the platform prioritize alternative authentication methods like passkeys or email-based verification.
