Revolut blocks GrapheneOS users

The block

Revolut, the banking app, has started blocking people who run GrapheneOS from logging into its app. GrapheneOS is a hardened Android build, the one I run on my own device, and the one I recommend to anyone who wants to turn the privacy dial up. The block came without justification from Revolut, and GrapheneOS called it out publicly.

Revolut is claiming it's doing this for security reasons. In reality, it's enforcing the licensing requirements of Google Play. The app checks Google's Play Integrity service to see whether the phone is running Google-certified firmware. GrapheneOS, being a custom ROM, albeit one based on the Android Open Source Project, fails that check. Not because it's insecure, but because Google does not certify it.

The security argument doesn't hold up

Here's the problem with Revolut's "security" claim. GrapheneOS is, by most objective measures, the most private and secure Android operating system available. It sandboxes apps, it strips out Google's proprietary services, and it hardens the kernel in ways stock Android doesn't. Yet Revolut's app is quite happy to run on stock Android 9, a version that hasn't had a security update in over 18 months. You can use a phone running unpatched, three-year-old Android that's trivially exploitable, but you can't use a hardened GrapheneOS device. That's not a security decision. It's a compliance decision dressed up as one.

GrapheneOS sent Revolut a compatibility guide, years before this, explaining how Revolut could use Android's hardware attestation instead of Play Integrity. Hardware attestation reports the actual hardware boot state, OS version, and patch level. It's a real security check: it verifies that the device is running what it claims to be running, on legitimate hardware. Play Integrity, by contrast, just checks whether Google certified the firmware. One checks security; the other checks licensing.

Revolut ignored the compatibility guide.

What Play Integrity actually does

On stock Android, you don't see Play Integrity checks happening. They run silently in the background. But GrapheneOS, when you run sandboxed Google Play services, tells you when an app is trying to reach the integrity service. Instagram, TikTok, social apps. They all do it routinely. On GrapheneOS you can see the requests; on stock Android they're invisible.

The check exists to prevent click farms and bot networks from running fake versions of Android on virtual machines, the kind of setup used for spam, fraud, and automated abuse. Hardware attestation would solve that problem properly, because it verifies the physical hardware. Play Integrity only checks whether the firmware carries Google's signature, which means it blocks GrapheneOS while doing nothing to stop a determined attacker running decompiled apps in a sandbox on a development machine.

In other words, the "security" measure Revolut is enforcing doesn't stop the people it claims to stop, and does block the people it shouldn't, ordinary users running a more secure operating system than the one Revolut is happy to accept.

The wider split

This isn't really about Revolut. It's a symptom of the internet splitting in two. On one side, people are moving toward free and open source software, things like F-Droid, GrapheneOS, LineageOS, self-hosted tools, and apps that respect your data. On the other, people who either don't know the alternatives exist or don't have the technical confidence to switch are giving more and more data to big tech companies, and increasingly to the state as well.

The only way this kind of thing stops is if more people ignore it and take the open source path. The options are there. Go on F-Droid, have a look around, figure out how to sideload APKs onto your Android phone. If you're on iOS, I'm sorry, but for everyone else, the door is open and the software is free.

And on this channel, we build open source versions of the utility apps people use every day, fitness trackers, goal trackers, calendars, so you can replace them one at a time with software that doesn't track everything you do.