Protect yourself against fraud

Fraudsters may use emails, text messages, chat messages or phone calls to impersonate Pleo, your bank or someone in your company. Learn how Pleo contacts you, how to recognise common warning signs and how to protect your account and cards.

How Pleo contacts you

Emails from Pleo always come from an address ending in pleo.io.

Pleo will never ask you to:

• Share your password, a one-time code sent by SMS or an authenticator app, or a login link sent to your email
• Forward, read aloud, paste or screenshot a login link or one-time code
• Approve a transaction, create a card, add a user, change an admin or move money during a call or message
• Install remote-access or screen-sharing software

How to recognise a scam

Scams can reach you in different ways:

• Phishing arrives by email
• Smishing arrives by text or chat message
• Vishing arrives by phone call

Common warning signs include:

• Urgency or threats, such as claims that your account will be blocked, your card has been suspended or a payment has failed
• A link to a login page that looks like Pleo
• A request for a password, code or login link
• A caller who knows real details about you or your company—this does not prove the call is genuine
• A sender address or website that resembles Pleo but contains an extra word, a different ending, a hyphen or a small spelling change

Before you act:

• Check the complete sender address and the full destination of any link.
• If a message asks you to log in, do not use its link. Open the Pleo app or type pleo.io or app.pleo.io into your browser yourself.
• Never share a login link or one-time code—even with someone claiming to be from Pleo, your finance team or your bank.
• If you are unsure, stop the conversation and contact Pleo through the in-app chat.
• Forward suspicious emails, texts or call details to support@pleo.io, then delete the message. Do not reply to the sender.

Protect your Pleo account

How you protect your Pleo account depends on whether you’re an admin or a cardholder.

For admins

• Review access under Settings → People. Remove people who have left the company and keep the number of admins small.
• Protect the email account linked to your Pleo login with strong authentication. Your email is used for login links, codes and password resets, so anyone who controls it may be able to access your Pleo account.
• Review card limits and use the lowest limits that still work for your team.
• Use virtual cards for online payments and single-use cards where possible.
• After any suspicious contact, check the People and Cards lists for changes you do not recognise.
• Set an internal rule that no payment, card or user change is made based only on an email, text or phone call. Verify requests through a channel you already trust.
• Watch for invoices with changed bank details and urgent requests that appear to come from a CEO or finance lead. Confirm them by calling a number you already have.
• Where available, strengthen account security with a third-party login provider or SAML SSO.

For cardholders

• Keep card details in the Pleo app. Do not store them in notes, spreadsheets or chat messages.
• Freeze your card in the app as soon as something looks wrong. You can unfreeze it if the activity turns out to be genuine.
• Check the merchant name and amount before approving a payment.
• Never share a code or login link.
• Report a lost or stolen card in the app and order a replacement.
• If a website where you entered your card details has been compromised, freeze the card and request a replacement.

Official Pleo SMS numbers

Use this list as a reference when checking whether an SMS may have come from Pleo:

• Denmark: +45 54 54 67 44 or 54 54 67 44
• Sweden: +46 79 09 52 623
• Norway: +47 594 427 84
• Italy: +39 339 995 0816
• Austria: +43 676 800 442 22
• Portugal: +351 923 249 791
• Spain: 215 342
• Netherlands: 7650
• Finland: 12150
• UK: 64171