Best practices for your Payhawk account security

Here are key steps you can take right now to protect your Payhawk account and avoid falling victim to fraud or phishing attempts.

Step 1: Enable two-factor authentication (2FA)

Add an extra layer of protection by enabling 2FA in your account settings. This requires a second verification step (like a code from an authenticator app) when logging in.

Step 2: Use a strong, unique password

See password requirements.

Step 3: Set up account recovery options

Ensure your email address and phone number are up to date in your profile. This helps you recover your account quickly if needed.

Step 4: Be extremely cautious with links

🚫 Do NOT
Click on search engine results for Payhawk or any financial services.
Open links from unexpected emails or messages.
Trust links sent via SMS, WhatsApp, or social media.

✅ Always
Access Payhawk only through the official website: https://payhawk.com.
Bookmark the site or type the URL directly into your browser.
Check for the security bar at the top of the page, confirming you're on the official platform.
Verify the link begins with https:// and the domain is correct (for example, payhawk.com).

Step 5: Use official channels only

Payhawk will never call you to ask you to open a link, log in, or share your password, card details, or verification codes.
If you receive a suspicious call claiming to be from Payhawk, hang up immediately.
Scammers can make any name or number appear on your phone screen, including Payhawk's. Your phone hasn't been hacked, and Payhawk's phone line is safe. Scammers use internet calling apps to show a fake name or number.
A scam call often starts with an automated message about a login or card payment in another city and asks you to press 1. A live caller can say they are from Payhawk Security or Support, can know your name and job title, and can call back from a slightly different number if you hang up.
For any questions or concerns, always use Payhawk's Web Portal, official website, or this Help Center to contact Payhawk Support or email the team at support@payhawk.com.
If you open the Payhawk Mobile App during a phone call, a banner reminds you that Payhawk is not calling you.

If you already shared details with a caller:

Change your password immediately.
Delete any trusted device you don't recognize.
Contact Payhawk Support immediately through chat or at support@payhawk.com.

If you're a Payhawk Administrator and you think your company's account is at risk, you can lock down the account.

Step 6: Review recent expense activity and trusted devices

Regularly monitor your account's security by reviewing the list of trusted devices logged into your profile.

To check which devices are trusted, open the user menu by clicking your avatar in the top-right corner, then go to Manage profile > Security.

Monitor your recent expense activity to ensure all transactions are legitimate. If you come across any charges that seem suspicious or unauthorized, report them promptly to Payhawk Support so they can investigate and take appropriate measures to secure your account.

If you see any unfamiliar trusted devices or detect suspicious expense activity:

Update your password immediately.
Contact Payhawk support via chat or email at support@payhawk.com.

Step 7: Keep your app and devices updated

Make sure you're using the latest version of the Payhawk app and that your phone or computer is updated with the latest security patches.

Step 8: Ensure a website, email or caller is really Payhawk

Use these checks to confirm that you're dealing with Payhawk:

Websites - Official Payhawk websites are on the payhawk.com domain, for example, payhawk.com and the Payhawk Web Portal at portal.payhawk.com. A website on any other domain is not an official Payhawk site, even if its name contains the word Payhawk (for example, payhawkhelp).
Emails - Payhawk emails come from @payhawk.com addresses. Notification emails always come from no-reply@payhawk.com, and card monitoring emails come from monitoring@payhawk.com.
Scammers can copy the look of Payhawk notifications, so check the full sender address, not only the sender name. If a suspicious email asks you to approve or review an expense or request, don’t use the links in the email. Open the Payhawk Web Portal or the Payhawk Mobile App directly and check your Inbox. If the pending action isn’t there, don’t click any links in the email, don’t reply to the email, and contact Payhawk Support through the chat.
Support - The official support channels are the Payhawk Web Portal, the chat in this Help Center, and support@payhawk.com.
Phone calls - Payhawk never calls you to ask for your password, 2FA codes, or card details. This includes automated (robot) calls, calls from foreign or unknown numbers, and calls that ask you to confirm a payment or a code. If you get such a call, hang up.

Stay safe. Stay informed.

If you're ever unsure about a link, message, or phone call, don't take a risk. Contact Payhawk Support directly.

Video guide on preventing your account from fraud

The following video shows best practices on how to prevent your Payhawk account from fraud.