An Unexpected Sign-In Prompt Is a Request You Can Refuse
Your phone asks you to approve a sign-in while you are doing something unrelated. The notification comes from the authentication app you use every day, so it looks familiar. That familiarity does not establish that the person trying to enter the account is you.
An approval prompt asks you to authorize an action. It is not merely an alert to dismiss by choosing whichever button makes it disappear. If you did not start the sign-in, deny the request and investigate through the service’s own trusted channels.
Connect the request to something you actually started
Before approving, ask which account and action the prompt belongs to. Were you signing in to that service on a device you control? Does the timing match? Are you working in an app or website you deliberately opened?
If you are uncertain, decline and start your own sign-in again from the official app or a known address. That gives you a fresh request you can relate to your own action. Do not use a link supplied by an unexpected caller or message to perform this check.
A location or device description can help you notice a mismatch, but it should not replace knowing that you initiated the request. Read the whole prompt rather than approving automatically because one detail looks plausible.
Do not approve a stream of requests to make it stop
Repeated unexpected prompts can be an attempt to wear down your attention. Security providers describe this as prompt bombing or MFA fatigue: the attacker hopes that inconvenience, confusion, or a mistaken tap will produce an approval.
Refuse the requests and use any built-in option to report suspicious activity. For a work or school account, contact the established helpdesk or security team. Include the affected account, approximate times, and whether you approved anything. Follow their incident process instead of trying to redesign the organization’s authentication settings yourself.
Keep the report factual. “I received six requests between these times and denied them” is more useful than guessing who is responsible. Repeated prompts warrant attention, but the notification alone does not tell you every detail of how the attempt began.
Check the account through an independent route
For a personal account, open its official security settings directly. Review recent activity and the recovery options available for that service. Follow its guidance for unrecognized sign-ins, including changing a compromised or reused password and addressing unfamiliar sessions or registered devices.
Authentication systems differ. Some prompts follow a password step; passwordless systems can begin from other information. An unexpected request is therefore a reason to investigate, not universal proof that someone already knows your password.
If you cannot get into the account, use the provider’s official recovery process. Avoid support numbers in search advertisements or messages that arrive conveniently after the prompts. A person claiming to help may be part of the same attempt.
Treat a caller’s instructions as a separate request
Someone may phone and claim to be technical support, your bank, or another service provider. They might say the prompt is part of cancelling an attack or ask you to read out an authentication code. Their explanation does not change what the approval or code actually permits.
Microsoft’s Authenticator guidance specifically warns about callers and messages seeking verification codes. Keep codes and recovery information private, end the unsolicited contact, and reach the organization through a channel you independently know.
The same principle applies to number matching. Only enter or select the number associated with a sign-in you started in a trusted session. A number dictated by a stranger does not become safe because the authentication app accepts it.
If you approved accidentally, say so promptly
An accidental approval should trigger action, not embarrassment or a wait to see whether something visible happens. Notify your workplace security team immediately for an organizational account. For a personal account, follow the provider’s compromised-account guidance through its official site or app.
Tell the responder what happened, including whether you also shared a password, code, or recovery information. Record the approximate time and any contact details involved, without continuing the conversation with the suspected impersonator.
Do not assume that changing the password alone ends every active session on every service. Use the provider’s specific instructions for signing out sessions, reviewing recovery details, and removing unauthorized access. Keep multifactor protection enabled while following the recovery process.
Choose stronger protection when the service supports it
Authentication methods offer different protections. The UK’s National Cyber Security Centre places FIDO2 credentials above challenge-based authenticator apps in its recommended order and distinguishes their phishing resistance. Number matching can help with push approvals, but it should not be treated as equivalent to phishing-resistant authentication.
Where appropriate, use supported passkeys or security keys and keep recovery arrangements current. For managed accounts, let the responsible team guide that change. Whatever the method, retain the immediate habit: an approval should correspond to an action you intended, and an unexpected request deserves refusal and a check.
