Pleo 2FA: how to set up an authenticator app

Pleo is a company spending tool for cards, receipts and reimbursements. Pleo is a financial institution covered by the EU's strong customer authentication rules, so two-factor login isn't optional. Every user signs in with a work email, a 4-digit passcode and a 6-digit code, and that code comes either by text message or from an authenticator app (Pleo, archived).

The catch: you pick the method once, when you set up your account, and Pleo's help says you can't switch it yourself later, even while signed in (Pleo, archived). After that, it takes an admin reset. This guide covers both routes. It uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Pleo steps come from Pleo's own help center, linked below, which we read on October 21, 2026. Pleo's help center blocks automated readers, so we read archived copies on web.archive.org, the newest saved between October 2025 and March 2026. The step-by-step setup article was last archived in April 2024, so its screens may have changed. We haven't tested the steps on a Pleo account. The Novaz steps are checked against the app, version 1.0.5.

Set up an authenticator app when you join Pleo

Your Pleo admin invites you by email. Pleo's setup article describes the flow like this (Pleo, archived):

1. Open the invite email and click through to Pleo, then choose Continue on web.
2. Enter your details and choose a 4-digit passcode.
3. When Pleo asks for a phone number, don't fill it in. Click Use authenticator app instead.
4. Pleo shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. Click Continue in the browser and type the 6-digit code that Novaz shows.

Pleo's help doesn't mention a text key to type instead, so plan to scan the QR code.

Already using text messages? Ask an admin

If you picked text messages at signup and now want an authenticator app, an admin needs to reset your two-factor login. Only Admins and controllers with extended access can do it (Pleo, archived):

1. The admin goes to People and selects you.
2. They open the three-dot menu and choose Reset two-factor login. (The same menu has Reset passcode, which is a separate reset.)
3. You get an email. Its link stays valid for 24 hours.
4. Follow the link and choose the authenticator app this time, then scan the QR code with Novaz as in the steps above.

Pleo's page on missing text messages suggests the same reset as the last fix when SMS codes don't arrive (Pleo, archived). See authenticator app vs. SMS.

When Pleo asks for a code

You need the code each time you log in, on the web and in the mobile app.

Two things cut down the prompts:

• After a successful login, you can choose trust this browser. Pleo then skips the code on that browser for a year, or until you log out (Pleo, archived).
• On a new device, Pleo first sends a verification email. Open its link on the same device and browser you're logging in on, or scan the email's QR code with the phone that has the Pleo app (Pleo, archived).

Signing in with Google or Microsoft skips the email and passcode, not the code (Pleo, archived).

If Pleo rejects your code

Pleo's help doesn't cover rejected authenticator codes. Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

Pleo documents no way to move the authenticator yourself. If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your Pleo codes keep working. If not, ask an admin for the same two-factor reset, then scan the new QR code on the new iPhone. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Pleo's help doesn't mention backup or recovery codes, so unless you can restore Novaz from a backup on a new iPhone, the way back in is a reset. Who does it depends on your role (Pleo, archived):

• Employees: ask an admin to choose Reset two-factor login for you, as above.
• Admins: another admin, or a bookkeeper with extended access, can reset you the same way.
• The only admin: Pleo Support can send a reset email, but first asks for proof that you control the company. Send the proof of transfer for your last Pleo Wallet top-up, or, if you've never topped up, a banking file showing the company name and account number.

Pleo doesn't say how long a Support reset takes. See also Lost the phone with your authenticator app?

Turning it off

Pleo's help describes no way to turn two-factor login off: its SCA page applies it to every login (Pleo, archived).

Official Pleo help

All read in archived copies on web.archive.org:

• Log in issues
• Reset authentication method
• Not receiving SMS code
• Issues with verification email
• Setting up your two-factor login
• If you forget your passcode or need to change your authentication method
• Log into Pleo with strong customer authentication
• What is Strong Customer Authentication and PSD2?