The locked account tool prevents high-risk actions from being taken on accounts that may have been compromised. It safeguards payment activity, contact methods, and account access.

When is it appropriate to click the button for your own account or for your employee’s account?

Use the Report Suspicious Activity button if:

You suspect unauthorized activity on your own or an employee’s account.
There are changes to bank accounts, logins, or suspicious payment activity.
You want to pause activity on an account until Concierge investigates.

Which features are locked?

The following actions are restricted when an account is locked in Expensify Classic:

Admin Functionality

If you are the owner of a reimbursement account in Expensify, all ability to process reimbursements for anyone with access to the bank account will be locked.
If you are a Domain Admin and have Expensify Cards, all Expensify Cards for the domain or workspace will be locked and all card activity will be suspended.

Profile settings

Adding a secondary login
Adding or removing Two Factor Authentication (2FA)
Domain Admins cannot reset Two Factor Authentication for Domain Members
Inviting Copilots

Wallet settings

Connecting, updating or removing bank accounts

Domain management

Adding or removing Domain Admins (Settings > Domains > Domain Admins)
Inviting or closing Domain Members (Settings > Domains > Domain Members)

Workspace members

Inviting, removing, or importing members via spreadsheet

Expensify Cards

Enabling Expensify Cards
Editing limits (Settings > Domains > Company Cards)
Showing card details
Activating cards from the Inbox
Adding to Apple Wallet/Google Pay
Requesting a new card

Note:

If the user is a Domain Admin, all cards under the domain will be locked.
If they are only a cardholder, only their personal cards are locked.

Reimbursements and payments

Clicking Reimburse on reports
Clicking Pay on bills if the member is a reimburser
- Applies to all items submitted by or payable by the locked member

How to do it?

Members: The Report Suspicious Activity button appears at the bottom of the screen in Settings > Account > Profile.
Domain Admins: You can lock a domain member’s account using the Report Suspicious Activity option located in Settings > Domains > Domain Members > Edit Settings.

Unlocking an account

This button is not reversible without the assistance of an Expensify team member. Once the account is locked, a member of the Expensify team will work with you to take the necessary steps to secure your account and remove any unauthorized access. Only once these steps are taken will the account be unlocked.

FAQ

Why can’t I unlock my account?

Account unlocks must be handled by Expensify to ensure the integrity of your data and prevent unauthorized access. Use Concierge for help, and we’ll guide you through the next steps.

Search

Report Suspicious Activity