An unexpected multi-factor authentication (MFA) prompt is not a routine notification to clear away. It can mean someone entered your password and is waiting for you to approve their sign-in. It can also come from an app with stale credentials, so the prompt alone does not prove an attacker is present. Either way, do not approve a sign-in you did not start.
First: deny the request
If the app offers Deny, No, or Report, use it. Do not approve the request just to make repeated notifications stop. Never read a displayed number or verification code to someone who calls, texts, or emails you. A real support representative should not need you to approve an unfamiliar sign-in.
Next, open the account from a trusted bookmark or type the official address yourself. Do not use a link from the notification, a message, or a search ad. If you are unsure whether the prompt was connected to something you just did, close the app and start the sign-in again yourself.
Change the password from a trusted device
If you did not cause the prompt, treat the password as potentially exposed. From a device you trust:
- Change the account password to a new, unique password.
- Do not reuse a variation of the old password.
- Review recent sign-ins, devices, and security alerts.
- Sign out unfamiliar sessions and remove unknown devices.
- Confirm that recovery email addresses and phone numbers are still yours.
If the same password was used anywhere else, change those accounts too. A password manager can create and store a different password for each site. Our guide on making yourself harder to hack explains how unique passwords, updates, and account recovery fit together.
Why repeated prompts matter
Attackers sometimes send many approval requests and hope that a tired, distracted, or confused person eventually taps Approve. CISA describes this as “push bombing” or MFA fatigue. Microsoft says number matching is an important security improvement for authenticator push notifications because the person must enter a number shown on the sign-in screen instead of accepting a simple yes-or-no prompt.
Number matching helps, but it does not make every prompt safe. If you did not start the sign-in, you will not have a legitimate number to enter. Stop and investigate.
Use stronger MFA when the account supports it
Any MFA is generally safer than relying on a password alone, but methods differ. Simple push approvals and text messages can still be targeted through social engineering or account and phone-number attacks. Phishing-resistant methods—such as passkeys or hardware security keys—are designed so a fake website cannot easily reuse the sign-in proof.
For important email, financial, administrator, and cloud accounts, review which options the provider supports. Keep at least one secure recovery method, store backup codes safely, and remove old phones or keys you no longer control. Do not disable MFA merely because prompts are annoying; fix the cause and strengthen the method.
Check email rules and connected apps
If the account is email, Microsoft 365, Google Workspace, or another business system, also review:
- Forwarding addresses and inbox rules you did not create.
- Third-party apps with account access.
- New administrator accounts or role changes.
- Changes to payment, banking, or payroll details.
- Messages sent from the account without your knowledge.
These checks matter because changing a password does not always remove an attacker’s existing session or a malicious forwarding rule. Business administrators may need to revoke active sessions and review audit logs. If sensitive business or customer information may have been accessed, follow the organization’s incident-response and notification obligations.
If you already approved the prompt
Act promptly. Change the password from a trusted device, revoke active sessions, review security information and connected apps, and contact the provider through its official support channel. If the prompt followed a suspicious email or download, use our step-by-step guide for what to do after clicking a suspicious link.
For a work account, report the event to the person who manages IT or security. Do not erase the device or delete evidence unless instructed; timestamps, alerts, and messages can help an investigation.
A practical rule for every approval
Pause and ask: “Did I just start this exact sign-in, on this exact service, from this device?” If the answer is no or unclear, deny it. MFA reduces risk, but it cannot protect an account when a user is tricked into approving an attacker.
User Friendly Security helps households and small businesses understand practical layers of account, device, and backup protection. Explore our security resources and protection options to choose a sensible next step. No security measure guarantees that an account cannot be compromised.