Two-factor authentication (2FA) is an extra layer of security that prevents unauthorized access to your account. 2FA is achieved by either setting up SMS authentication or installing a general-purpose authenticator app on your mobile device. 2FA is required for all Brex users.



We recommend using an authenticator app (see examples below). Authenticator apps provide greater security than SMS, and can be used without a working cell network.

Note:

 Brex doesn’t require installation or download of a browser extension to access your account. You should always exercise caution when installing browser extensions.

When you sign in to Brex using 2FA, you’ll receive a prompt to provide a verification code in addition to your password. Brex offers two ways to receive a code:

Authenticator app (e.g., Google Authenticator, Twilio Authy, Okta, Duo, 1Password)

Please read the relevant section below to either set up 2FA for the first time or switch from one method to the other.



 If you’re using SSO as your preferred sign-in option, you won’t need to complete 2FA during sign-in.

If your 2FA code has stopped coming through, you or your admin can reset your 2FA method

Two-factor authentication (2FA)

The Brex business account provides customers with a place to bank*, manage operational spend, earn yield through money markets funds, and store funds but with a unique structure that limits your exposure to any individual bank. Even though you can still use a Brex business account for tasks such as bill pay or to send/receive checks, ACHs, and wires, there are some key differences in money storage.

*Banking services are only available to customers with Checking, Treasury, and Vault. Brex is a financial technology company, not a bank. Checking accounts and banking services are provided by Column National Association, Member FDIC.

As part of the Brex business account, Brex leverages its affiliate Brex Treasury, a broker-dealer regulated by FINRA/SEC, to sweep (i.e. move money before the end of the day) customer deposits into FDIC-insured partner banks.

This service—known as Vault—provides access to additional FDIC-insurance by sweeping customer deposits across multiple partner banks for up to $6M of coverage.

Please 

For an overview of our program banks, please refer to our 

. For more information about Vault, please review your 

With Brex’s Treasury Service, funds can also be swept into a money-market mutual fund administered by Bank of New York Mellon ($400B+ bank, 

] has daily liquidity and is designed for preservation of capital and maintenance of liquidity, and it must hold at least 99.5% of its money in cash or securities backed with the full faith and credit of the US government.

Though there are inherent risks within any financial system, Brex business accounts are designed to offer less exposure than an individual bank due to these qualities:

100% of funds in Brex business accounts are always available for withdrawal.

Brex does not hold customers’ cash on our balance sheet, except for money in transit.

Brex allows you to choose how your money is stored between your checking, vault, or treasury accounts.

Brex business account risk exposure

Fraud and cybersecurity attacks, especially phishing attacks, have been on the rise. At Brex, we take the security of your personal and financial information seriously, and we're regularly investing in security measures to better protect you.

Every Brex account has multiple security controls to protect it from scammers who may have gained access to your sign-in credentials via phishing attacks. Phishing refers to a criminal’s attempt to steal your confidential information, such as passwords or account numbers, through deceptive means. Phishers often pose as employees, third-party agents, websites, or chatbots — even impersonating Brex employees or affiliates.

In your dashboard under 

, you can monitor potentially suspicious activities, such as devices that have access to your Brex account, merchants that have your cards on file, and sign ins/purchases that we’ve flagged as potentially suspicious. If any of these entries seem unusual, you can click into them for more details or to take action accordingly.

Anyone who chats, calls, or emails Brex Support on behalf of your account will be asked to pass a security check before we can provide them with any account-specific information. For the most efficient experience, please chat with us through your dashboard or call us from the phone number associated with your account.

We allow your Brex cards — virtual or physical — to be locked at any time. This can be done by both the cardholder and account/card admins in your Brex dashboard. The cardholder themselves can also lock their own cards in their Brex app.



 If the account/card admin locks a card on behalf of the user, only an account/card admin can unlock it.

Locking your Brex card will prevent any charges from going through until it's unlocked. You should lock your card if you temporarily misplace it or have reason to believe there may have been fraudulent transactions.

Delayed authorizations (such as some transit purchases)

If you find your card or rule out fraud, you may easily unlock your card through the Brex dashboard or the mobile app. Please note that your card number will not change.

We also keep an eye out for any suspicious transactions that take place on your card. If we detect unusually spend, your card will lock automatically and we’ll notify you via SMS so you can review potentially fraudulent transactions. If you find the transactions are valid, you can unlock your card from the notification and continue spending as usual. If you don’t recognize the expense, you can submit a fraud dispute by signing into Brex.

The audit trail displays a series of events so that admins can track events performed on the Brex platform, including the type of event, data modified, who performed the event, where the event was performed (physical location), IP address, and when the event was performed.

To view the audit trail, click 

. Here, you can view, filter, and export a CSV list of all the events going back 90 days. To view more details about an event, select the expense you’d like to know more about.

You can export based on date, actor (user), actor type (API, support, user, system), target type, event type, or specific event.

If you have trouble exporting a list of events, please reach out to our Support team.



: Currently, the audit trail displays events related to policy, users, expenses, bills, accounting, reimbursements, budgets and spend limits.

Security measures Brex takes

We want to do everything we can to help you keep your account and business information safe. There are different tactics that bad actors might try using to gain access to your account. Being aware of them can help prevent unauthorized activity. This guide explains possible types of fraud and tips for protecting yourself and your company.

Our multi-pronged approach to security at Brex significantly reduces cybersecurity attacks. Even so, it’s important that we remain vigilant together. To help protect your account, please follow these best practices:

Go to brex․com or dashboard.brex.com directly to access your account: 

Scammers may create fake ads and websites that appear in search results and look like Brex — to trick you into giving them your information. Avoid malicious search results by adding brex.com as a bookmark in your browser.

Be suspicious of any email, text message, or call that requests your personal or account information:

 Please do not click any unsolicited links or open any attachments. Brex will only ask you to open a link sent by email to verify your device when signing in from a different device, or after clearing your browser cookies.

Make sure your devices and applications are up-to-date:

 Software updates often include the latest security features to protect your device.

Monitor your account for fraudulent activity: 

If you suspect that someone has gained unauthorized access to your Brex account, please change your Brex password immediately. Create a password that has not been used on any other account.

Brex requires two-factor authentication (2FA) for secure sign-in. Brex will never ask you to bypass 2FA or require you to install a browser extension to sign in.

Report any possible scam, such as a fake Brex website or ad:

 Reporting fraud is essential for preventing and addressing cybersecurity attacks.

If you run into any security concerns related to the tips above, or if you think your account’s security may have been breached, please 

Account Takeover (ATO) fraud is a type of identity theft where a malicious third party “takes over” an online account such as bank accounts, social media profiles, or email addresses. ATO takes advantage of users’ vulnerabilities, such as reusing passwords and falling victim to phishing scams.

The foundation for a successful account takeover is access to a user’s account credentials. Here’s how attackers usually compromise legitimate accounts:

 This includes password spraying (guessing common passwords for a given user). The attacker, usually through an automated script, tries a username/password combination across many accounts until one works.

 Credential phishing remains a highly effective way to get a user’s password. Without barriers like multi-factor authentication (MFA), stolen credentials lead to compromised accounts.

 Keyloggers, stealers, and other forms of malware can expose user credentials, giving attackers control of users’ accounts.

Business Email Compromise (BEC) is a type of scam in which an attacker targets a business’s email to defraud the company. When BEC is successful, after gaining control of the email account, the attacker will typically try to defraud the company or others by impersonating either the company or an employee of the company.

BEC usually starts with the fraudster posing as someone the recipient would know or trust, like a boss, coworker, or vendor. They may ask the recipients to make a wire transfer, divert payroll, change banking information for future payments, provide personally identifiable information, or send wage/tax forms. Fraudsters use a variety of impersonation techniques, such as creating copycat websites that appear to be legitimate but actually belong to attackers. They usually provide some form of an attachment or link for the recipient to click. For some BEC attacks, once the recipient clicks on the item, malware is then installed on the recipient’s computer and the attacker can gain access to the recipient’s computer.

At Brex, we're regularly investing in security measures to better protect you and your card. To help us do this, please follow these best practices.

Do not share your card details through a live channel (chat, email, or phone), even with Brex Support. Although we do everything we can to secure our systems, we cannot guarantee that your computer and network are secure.

When making purchases, look for https:// at the start of your URL — nearly all https:// website traffic is encrypted. Only enter your card number during checkout on trusted sites.

Bad actors may try to gain access to sensitive information by posing as reputable sources. Never send your card number over email or other messaging platforms.

Regularly review your transaction history to ensure all payments are expected and legitimate. If you suspect that someone has gained unauthorized access to your account, please change your Brex password immediately and contact Brex Support.

If you’re anticipating an unwanted charge coming through on your Brex card, you won’t be able to block it, but you do have other options. If you suspect that the charge might be attempted fraud, or a merchant is continuing to charge your card without your consent, please read about submitting a dispute.

Brex values the trust our customers place in us. Protecting your information through the security and integrity of our systems, infrastructure, applications, and data is our priority. If you believe you have discovered a vulnerability in our systems or applications, we ask that you please disclose it to us in a responsible manner using the form below. All reports will be subject to our 

.

By submitting the form, you acknowledge you have read, understood, and agreed to abide by the guidelines described in the disclosure policy. Brex will not take legal action against researchers who discover and report vulnerabilities in good faith and that adhere to this disclosure policy, and will work with you to validate the suspected vulnerability.

You can learn more and file a disclosure on our 

A card testing attack begins with bad actors rapidly testing thousands of potential credit card credentials. They use various digital tools, including bots or scripts, that can cycle through hundreds or thousands of numbers on an ecommerce site.

The main objective is to quickly identify a valid card and/or reveal a card’s missing security elements. This type of fraud is common across the entire credit card industry and does not necessarily mean that your card number has been compromised. Parameters like card expiry and CVV can prevent unauthorized charges. Unfortunately, processors and merchants do not always enforce these parameters.

Security is of utmost importance at Brex and we take strong measures to protect your account, including:

Automatic card locking in response to suspicious activity

Working with major issuing banks to share learnings and implement industry-leading responses

If you see unauthorized charges, please file a dispute. You can also chat with our support team by clicking 

Protecting your Brex account

You can sign into your Brex account from brex.com by clicking 

If you face any trouble while doing this, please follow the steps below depending on your issue.

Brex uses multi-factor authentication (MFA) to provide an extra layer of security to your account, which includes two-factor verification (2FA) and device verification.

To keep your Brex account even more secure, we use device verification. This is a one-time authorization needed for each browser on every device you use to sign in to Brex. Device verification helps make sure that only your approved devices and IP addresses can access your Brex account.

If you have problems verifying your device, please troubleshoot using the suggestions below.

HC - Sign In Trouble 01

Sign in help

System and Organization Controls 1 (SOC 1) is a report that evaluates a service organization's internal controls related to financial reporting. System and Organization Controls 2 (SOC 2) is viewed as a robust audit of a business that outlines current approaches to security controls. These certifications provide customers and partners with more confidence in business operations.

Brex is currently SOC 1 Type 2 and SOC 2 Type 2 compliant. Our SOC 1 Type 2 and SOC 2 Type 2 reports can be found on our 

SOC 1 and SOC 2 compliance

Get answers to all of your questions regarding Brex

Security

Two-factor authentication (2FA) →

Brex business account risk exposure →

Security measures Brex takes →

Protecting your Brex account →

Sign in help →

SOC 1 and SOC 2 compliance →