In Los Angeles, cashier Audrey Stockman spends her birthday upset after being dumped, via text, by her boyfriend Drew. Her best friend and roommate, Morgan, convinces her to burn Drew’s things and sends him a text as a heads up. Unbeknownst to Audrey, Drew is a government agent being pursued by men trying to kill him. He promises to return and asks Audrey not to burn his things in the meantime.
At her job, Audrey flirts with a man who asks her to walk him to his car. She is forced into a van. Inside, the man identifies himself as Sebastian Henshaw and states that Drew works for the CIA and has gone missing. Audrey admits talking with Drew the night before, but is allowed to go home. Drew shows up to retrieve his possessions, including a fantasy football trophy. People begin shooting at them and Drew tells Audrey that, if anything happens to him, she must go to a certain café in Vienna, Austria, and turn over the trophy to his contact. Drew is then murdered by a man Morgan had met at the bar the previous night.
Morgan convinces Audrey to do what Drew said, and go to Vienna. At the café, Sebastian appears and demands the trophy at gunpoint. Audrey reluctantly hands it over, before the entire café is attacked. Audrey and Morgan defend themselves and flee, chased by men on motorcycles. Audrey reveals that she still has Drew’s trophy, since she switched it with one of several decoys they purchased. They board a train to Prague and discover that the trophy contains a USB flash drive. Morgan calls her parents, who tell her they can stay in Prague with Roger, a family friend.
Audrey and Morgan make it to the apartment, but quickly realize that “Roger” is actually a spy who killed the real Roger. He proceeds to drug the two ladies. Audrey tries to get Morgan to swallow the flash drive. When that fails, Audrey tells their captors that she flushed it down the toilet.
The ladies wake up in an abandoned gymnastics training facility, about to be tortured by Nadedja, a Russian gymnast/model/assassin trained by an older couple who had previously masqueraded as Drew’s parents. The couple reveals that Drew was discreetly negotiating with them to sell the flash drive, and Audrey came along as part of his cover. Audrey and Morgan are rescued by Sebastian, who defied orders to save them. He brings them to meet his boss in Paris, where they once again tell the CIA and MI6 that the drive was flushed. The women are given tickets back to America, and Sebastian is placed on leave.
As Sebastian drives the women back to the airport, Audrey confesses that she hid the drive in her vagina. When Sebastian is unable to decrypt the information, Morgan calls Edward Snowden – who had a crush on her when they were kids – and he helps them hack the drive.
The trio travel to a hostel in Amsterdam, where they are attacked by Sebastian’s CIA partner Duffer, who wants to sell the drive himself. They are rescued by their hostel roommate, who thinks they are being robbed and body slams Duffer to his death. Audrey responds to a text sent to Duffer’s phone and agrees to sell the drive at a private party in Berlin. To get into the party, Audrey and Sebastian disguise themselves as the Canadian ambassador and his wife, while Morgan pretends to be a member of the entertainment acrobatic troupe.
In Berlin, Sebastian is attacked, and Morgan is confronted by Nadedja on an acrobat swing. Morgan eventually kills Nadedja by throwing her onto nearby spikes. Meanwhile, Audrey goes to meet the mysterious contact and discovers Drew, still alive. Drew acts suspiciously and goes through her purse to find the flash drive. Sebastian arrives, being held hostage by Drew’s “parents”. After a standoff, Drew’s “parents” are killed, leaving Sebastian and Drew, who accuse each other of trying to hurt Audrey. Drew then shoots Sebastian, and Audrey pretends to be glad before grabbing Drew’s gun. After Drew tries to attack Audrey, Audrey kicks him in the crotch, then he falls to the ground when Morgan throws a cannonball at him. Drew is arrested, and Audrey, Morgan, and Sebastian walk away.
Sebastian later gives Morgan his untraceable phone so she can call her parents to tell them she is alive. While on the phone, Morgan receives a call from Sebastian’s boss telling him he is off suspension. Morgan begs her for a job as a spy. Meanwhile, Sebastian and Audrey share a kiss.
A year later, while celebrating Audrey’s birthday in Tokyo, her party is revealed to be a ruse. Audrey and Morgan are there on assignment with Sebastian to stop a group of Japanese Yakuza gangsters.