What to do if an MFA prompt you didn't request appears
An approval prompt you didn't start means someone else may have your password. Deny it — never approve to make it stop.
Sign-in prompts only appear when someone enters your password. If that wasn't
you, treat it as a live break-in attempt that your [[mfa]] is currently
blocking.
Do this now
- Tap Deny (or No, it's not me if offered).
- Do not approve — not even to silence repeated prompts. Attackers send prompt
after prompt hoping you'll tap approve out of fatigue.
- Change your password as soon as you can, from a device you trust.
- Tell your IT support team what happened and when — fast reporting lets them
check sign-in activity and shut the attempt down.
- Keep denying any further prompts until you've changed the password.
Once the password changes, the stolen one is useless and the prompts stop.
Why this happens
Your password was likely caught by [[phishing]] or exposed in a website breach
and is being tried against your account. The prompt is the last lock on the
door — as long as you don't approve, the attacker stays out.
If that didn't work
If you approved a prompt by mistake, say so when you report it — it changes
what your IT team checks, and telling them immediately is what matters. Nobody
will blame you for an honest tap.