Phishing, smishing and vishing: what to do

Phishing, smishing and vishing are scams designed to trick you into sharing sensitive information or giving someone access to your account:

• Phishing arrives by email
• Smishing arrives by text or chat message
• Vishing arrives by phone call

Before you act

• Check the complete sender address and the full destination of any link. Fake websites may use an extra word, a different ending or a hyphen to look like Pleo.
• If a message asks you to log in, do not use its link. Open the Pleo app or type pleo.io or app.pleo.io into your browser yourself.
• Do not assume a message or call is genuine because it uses the correct branding or includes real details about you or your company.
• If you are unsure, stop the conversation and contact Pleo through the in-app chat.
• Forward suspicious emails, texts or call details to support@pleo.io, then delete the message. Do not reply to the sender.

If you shared a code or login link

Follow these steps in order:

1. Freeze your cards:
   1. Open Cards in the Pleo app.
   2. Select each affected card.
   3. Select Freeze.
2. Contact Pleo immediately through the in-app chat or at support@pleo.io. Tell us explicitly that you shared a code or login link—it changes how we handle the case.
3. Change your Pleo password and sign out of all devices.
4. Check the People list:
   1. Open Settings → People.
   2. Look for users you do not recognise or users who have unexpectedly been given admin rights.
5. Check the Cards list. Look for cards you did not create, especially virtual cards.
6. Review recent transactions. Report anything you do not recognise in the Pleo app:
   1. Select the transaction.
   2. Select the three-dot menu in the top-right corner.
   3. Select Report fraud transaction.
7. Change reused passwords. If you used the same password anywhere else, change it there too, starting with your work email.

If you received a suspicious message but did not share anything

1. Do not reply, open attachments or use any links in the message.
2. Forward the message to support@pleo.io. If it was a suspicious phone call, send us the caller's details and a summary of what they asked you to do.
3. Report the message to your email provider or mobile network provider where possible.
4. Delete the message to avoid interacting with it accidentally.
5. Continue to monitor the People, Cards and recent-transactions sections of your Pleo account.

Remember

Pleo will never ask you to:

• Share your password, a one-time code or a login link
• Approve a transaction or move money during a call or message
• Create a card, add a user or change an admin during a call or message
• Install remote-access or screen-sharing software

Official Pleo SMS numbers

• Denmark: +45 54 54 67 44 or 54 54 67 44
• Sweden: +46 79 09 52 623
• Norway: +47 594 427 84
• Italy: +39 339 995 0816
• Austria: +43 676 800 442 22
• Portugal: +351 923 249 791
• Spain: 215 342
• Netherlands: 7650
• Finland: 12150
• UK: 64171