Revolut mobile finance - not supported on devices with custom firmware problem

rigel24 what would you think about microG on the grapheneOS environment?

Why and for what?

rigel24

Do not waste your time with microG and private space! Here is how I have it on "normal" way:

First make sure you have all login info (phone number and 6 digit pin). Than uninsatll revolut, also from private space. If you have private space only for this it is good to remove private space too. Than go to "settings/apps/show all" and check if you still have revolut there (it is possible that you have it there but you do not see it elswhere). Uninstall from here too.

Than you are free to go to to download the older version:
https://www.apkmirror.com/apk/revolut-ltd/revolut-better-than-your-bank/revolut-better-than-your-bank-10-54-release/revolut-spend-save-trade-10-54-android-apk-download/download/?key=b283933bdfa8a8bd46a15259c1a78a04e93bbe3c

Also download apkmirror installer (later you can uninstall it when above older version of Revolut is installed and works):
https://play.google.com/store/apps/details?id=com.apkmirror.helper.prod

apkmirror installer will find downloaded package and perform install of revolut 10.54. When done, sign in and authenticate with photo.

Finally uninstall apkmirror installer and update revolut via playstore or just leave it in older version....

PGOSUW2P9 I have commented some post ago: i had no issues to login into revolut app (10.56) with crDroid in a poco x3 NFC, no root

cdflasdkesalkjfkdfkjsdajfd

yep it is not an issue on any other lineageos based ROM. I had no issue on calyos with Pixel9 too. Now as someone mentioned it is also works fine on GOS with this trick I have detailed above too...

PGOSUW2P9 Now as someone mentioned it is also works fine on GOS with this trick I have detailed above too...

It works fine because you are signing in using an older version of the app, which does not block you from signing in. If it is the case that version 10.56 and later work fine for signing in with and signing up to an account on LineageOS derivatives, then that is a sign that Revolut's blocking of "custom firmware" is even more misplaced than we assumed (if you're really going to block non-Google certified OSs, then at least block the ones that lag behind in privacy and security patches).

Recently, I sent messages to Revolut's customer support. My first email said:

Dear Revolut Support Team,

I am writing to express my concern regarding the recent update to the Revolut Android application, which has rendered it inaccessible on my device. I am using a Google Pixel 9 Pro XL running GrapheneOS, a security-focused operating system. It appears that the latest update employs the Play Integrity API to verify device security, resulting in the app's incompatibility with GrapheneOS.

This situation poses a significant inconvenience, as it restricts access for users who prioritize enhanced security through alternative operating systems. Notably, Android's hardware attestation API offers a more robust attestation method than the Play Integrity API and allows for the whitelisting of keys from alternate operating systems. GrapheneOS not only adheres to the app security model but also substantially reinforces it. Therefore, restricting its use cannot be justified on grounds of security or fraud prevention.

I kindly urge your development team to consult GrapheneOS's Attestation Compatibility Guide to implement a verification method that accommodates the security integrity of systems like GrapheneOS.

Thank you for your attention to this matter.

Sincerely,
YYY

Got reply:

Hi there,

Thank you for waiting for our response! We appreciate your kind patience

I understand that you need help with a concern related to your account. Unfortunately, we could not find any account with the email address you are contacting us from. Would you be so kind as to confirm the email address and phone number (along with the country code) associated with your Revolut account? Also, if you have access to that email address, we can send you an email there and continue.

You can also reach out to us via chat. How?

To initiate the in-app support chat please follow these steps:

Revolut app home screen → Profile picture or initials/name → Help → Select the topic of your inquiry → Scroll down to "Help with something else" → Press “Chat with us" → type “Live agent” to connect with an agent.

If you are not logged into the Revolut app on your phone, you can chat with us anonymously. How?

Enter your mobile number that’s associated with your Revolut account → Click "Continue" → on the "Enter your password" screen, tap the "FORGOT?" bottom → Tap "Support" in the top right corner → tap "New Chat".

Thank you for your cooperation!

Best Regards,
XXX

My last email said:

Hi XXX,

Thank you for your response.

Unfortunately, it seems there is some misunderstanding. The issue I am reporting is not related to account access or incorrect account details. It is about a technical limitation with the Revolut app itself after a recent update.

Specifically, I am unable to log in or sign up at all on my device. When I tap the Login button, I immediately receive the following error message:
"Sorry, Revolut is not supported on devices with custom firmware."
At this point, the app becomes entirely unusable, preventing any further actions, including starting an anonymous chat through the app.

For context, I am using a ZZZ running GrapheneOS, a security- and privacy-focused Android distribution. The firmware in GrapheneOS is identical to the stock firmware provided by Google for Pixel devices, ensuring full system integrity. In fact, GrapheneOS enhances Android's app security model, making it a highly secure environment.

The issue seems to be caused by Revolut's recent implementation of the Play Integrity API for device verification. However, Android’s hardware attestation API provides a more robust and flexible alternative, allowing for the secure whitelisting of trusted systems like GrapheneOS. Excluding GrapheneOS users based solely on Play Integrity checks cannot be justified on security grounds, as this environment is at least as secure as the stock operating system.

I kindly request that this issue be escalated to the Revolut development team for review. Adopting a more inclusive attestation method would help avoid unnecessary inconvenience for security-conscious users. The Attestation Compatibility Guide from GrapheneOS offers clear recommendations on verifying the security integrity of such systems.

Thank you for your time and understanding. Please let me know if you need further details or clarification about this issue.

Best regards,
YYY

I received the following final reply:

Hi there !

We really appreciate your feedback! We are always trying to improve our product to provide you with a better experience. I will be sure to pass your suggestion onto our team for their consideration as we move forward with Revolut.

While I cannot provide a timeline, please check back on our website periodically for any updates. If you have any further questions please let me know.

Thank you,
Kind Regards,
Revolut Customer Support

It seems like this is just a perfunctory conversation and won't actually achieve anything.

I also reached out to customer support and this is the response I got:

Hello,

Our application might work on phones running MicroG, GrapheneOS or other operating systems however, we do not officially support it or conduct any compatibility tests. This means the application may have limited functionality or might not be usable at all.

As of now, we have no plans to support those systems in the foreseeable future.

Thank you for understanding and sorry for the inconvenience caused.

Kind Regards

Revolut Customer Support

And they completely ignored my suggestions to use hardware attestation...

rigel24

PGOSUW2P9

Your described process with version 10.54 worked also for me. I was not successful with any higher version. Thank you!

hungrily6100 Yeah, I personally always feel slightly frustrated when CSRs send me canned replies. On the other hand, in this case they did agree to forward it to developers (I hope that's what they meant by "team"), which is more than most CSRs usually do, in my experience. I try to keep in mind that the canned responses are usually lines (or variations of them) that they are obligated to provide, so I'll usually be receiving them anyway.

Ramojus

Yeah, that's verbatim the response I received from the CSR I chatted with a few days ago. However, when I kept pushing the matter the CSR agreed to forward my feedback to the development team. Here's what I wrote after receiving their first canned response. Note that I might've just got lucky in that the CSR was slightly more customer-oriented in general. And also, if someone's contacting Revolut about this, please don't use this text verbatim, as they might get suspicious that we are (or that I am) spamming them on the matter:

I am aware that GrapheneOS is not officially supported. However, it has never been officially blocked, up until now. It appears that the Android app version 10.56 is now blocking new sign-in attempts. This is not only my observation but is being observed by all GrapheneOS users I have talked with who have attempted to sign in. They have been locked out of your service.

For background: GrapheneOS is not an
operating system that's certified by Google but is still closely based on Android. The Revolut app works fine on GrapheneOS when already signed in, and has always worked fine for me, except that the app is now blocking new sign-in attempts. I use GrapheneOS because it focuses extensively on users' privacy and security, and builds on Android's own security and privacy features while also strengthening them. I very much care about the security of my device and I'll be unable to use your product if you block GrapheneOS.

Your developers can allow GrapheneOS specifically by following this guide:
https://grapheneos.org/articles/attestation-compatibility-guide

To summarise: GrapheneOS is keeping fully up to date with the latest Android patches and versions, and has pioneered security features that Apple has now integrated into iOS, such as auto-reboot and contact scopes. There's no reason that the app should allow users to run it on Android 7 - which has not received security updates for years - but block an OS that's recognized for its security features and implements the full Android security patches each month.

Kindly asking that my feedback be forwarded to the
development team for consideration.

Good news!
I got a reply to my 1-star review from Revolut:

"Hi XXX. We are sorry to hear that you are not able to use our app on the Graphene OS. Please note that you will soon be able to use Revolut again on your device, as our team is already working on it. Thanks."

So it seems, that we were loud enough!

stfn Sounds like great news! Thanks for sharing.

Just left my 1 start review, even though at the moment I'm currently on stock.

" Stopped working on GrapheneOS which has a stronger security model than Google's Play Integrity API.
Time to move on from Revolut if you don't revert your decision.

Thank you "

stfn that's great, I'll wait then because I quite like Revolut.

stfn Not too hopeful. These are usually comments that just hope that customer service will react quickly. I hope I'm wrong...

cdflasdkesalkjfkdfkjsdajfd Not too hopeful. These are usually comments that just hope that customer service will react quickly. I hope I'm wrong...

I hope it's not just some customer service representative that has misunderstood some feedback they received from a developer, and assuming wrongly that they are allowlisting GrapheneOS. They seem to have been given stock replies that they are handing out to us almost verbatim, and this is the first time they've said that it'll start working again. But we'll see!

Since they sent me a case ID I already sent them an email about it (adding info to my previous contact with them; I was honest about already having been in contact with Revolut support via the app, so I don't think they'll see it as spam). No harm in us continuing to push this, as long as they don't see it as spam.