Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

The massive theft of more than 153 million US and Canadian driver’s licenses earlier this month should make one thing abundantly clear: the safest place for a copy of your driver’s license is nowhere at all.

The leaked IDs, which appear to have come from an identity verification provider, ended up on a dark web identity service dubbed Nexus, alongside millions of other stolen identity and travel documents.

The danger was underscored this week after fintech Revolut revealed it had been tricked by a hacker into handing over reams of sensitive customer data, including copies of passports and verification selfies. The hacker is now drip feeding the identification documents of 680 customers onto the web in an attempt to secure a 10,000 Bitcoin ransom.

The irony is hard to miss: Know Your Customer (KYC) processes are designed to make financial systems safer by establishing who customers are and making sure they’re not up to nefarious deeds.

But the way KYC is usually implemented requires companies to store vast quantities of sensitive information, which creates valuable honeypots for criminals.

And the problem is getting harder to ignore. In the first half of 2026 alone, US data breaches affected at least 343 million people, according to the Privacy Rights Clearinghouse. Even more frustratingly, it’s already possible to verify an individual’s identity without storing their identity documents using zero knowledge proofs: