Recent identity thefts linked to Revolut users have renewed scrutiny of how companies collect and store customer identity documents, with security experts arguing that zero-knowledge technology could offer a safer path to compliance without hoarding sensitive personal data.
The Problem With Storing Identity Data
Know Your Customer, or KYC, rules require financial firms and crypto platforms to verify the identities of their users, typically by collecting passports, driver's licenses and other sensitive documents. The trouble is that this creates massive centralized databases of personal information, turning every company that gathers such records into a tempting target for hackers.
When these repositories are breached, the consequences fall on ordinary users whose stolen documents can be used for fraud, impersonation and financial crimes. The incidents involving Revolut customers underscore how quickly compromised identity data can translate into real-world harm, even when the original company itself is not directly at fault.
Verifying who someone is should never require permanently storing the very documents that make them vulnerable.
The core issue is a mismatch between what regulations demand and how they are implemented. Compliance requires proof of identity, but current practices default to keeping copies of everything, long after the initial verification is complete.
How Zero-Knowledge Proofs Could Help
Zero-knowledge cryptography offers a way to confirm facts about a person without exposing the underlying data. In practice, this means a platform could verify that a user is over a certain age, is a real person, or meets regulatory criteria without ever seeing or storing the actual documents behind those claims.
Advocates argue that adopting this approach would dramatically shrink the attack surface for identity theft. If companies never retain sensitive files in the first place, there is nothing valuable for hackers to steal in a breach.
- Prove identity attributes without revealing raw documents
- Reduce the risk of large-scale data leaks
- Give users more control over their personal information
Despite the promise, the technology has yet to become standard practice. Adoption faces hurdles including regulatory uncertainty, the cost of overhauling existing systems, and the inertia of established compliance workflows that already function within legal requirements. Until those obstacles are addressed, experts warn that identity data will remain concentrated in vulnerable databases, and breaches like those affecting Revolut users are likely to continue.