Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

Zero-knowledge technology could let companies verify who you are without storing your identity documents. So why isn’t it already standard practice?

The massive theft of more than 153 million US and Canadian driver’s licenses earlier this month should make one thing abundantly clear: the safest place for a copy of your driver’s license is nowhere at all.

The leaked IDs, which appear to have come from an identity verification provider, ended up on a dark web identity service dubbed Nexus, alongside millions of other stolen identity and travel documents.

The danger was underscored this week after fintech Revolut revealed it had been tricked by a hacker into handing over reams of sensitive customer data, including copies of passports and verification selfies. The hacker is now drip feeding the identification documents of 680 customers onto the web in an attempt to secure a 10,000 Bitcoin ransom.

The irony is hard to miss: Know Your Customer (KYC) processes are designed to make financial systems safer by establishing who customers are and making sure they’re not up to nefarious deeds.

But the way KYC is usually implemented requires companies to store vast quantities of sensitive information, which creates valuable honeypots for criminals.

And the problem is getting harder to ignore. In the first half of 2026 alone, US data breaches affected at least 343 million people, according to the Privacy Rights Clearinghouse. Even more frustratingly, it’s already possible to verify an individual’s identity without storing their identity documents using zero knowledge proofs:

Efrat Fenigson, host of You’re The Voice podcast, writes and speaks extensively about privacy and KYC. She tells Magazine:

So how many more of these leaks will it take before that will starts to bend?

KYC systems today have pretty much evolved around the assumption that institutions should see customers’ passports or driver’s licenses, record the relevant information and then store evidence of the check.

343 million people have already been affected by US data breaches in 2026. Source: Privacy Rights Clearinghouse.

But there’s an obvious problem with that approach: it has created a vast ecosystem of identity providers, databases, vendors and compliance systems that all store separate treasure troves of your individual KYC data. Every additional copy of your data creates another potential point of failure — and hackers are increasingly creative about devising ways to access it.