Accounts & passwords
Why am I getting sign-in approval requests I didn’t ask for?
Your phone buzzes with “Are you trying to sign in?” and you aren’t. Or a verification code arrives out of nowhere. It’s tempting to tap approve just to make it stop, and that’s exactly what attackers are hoping for. An unexpected prompt almost always means someone has your password.
The short version
If a prompt surprises you
- Tap deny or ignore it. Never approve.
- Change that account’s password now.
- Sign out of all other sessions.
- At work, tell IT straight away.
What an unexpected prompt means
Multi-factor authentication (MFA) only asks for approval after someone has entered the correct password. So an approval request or code you didn’t ask for usually means:
- Someone has your password, often from a phishing page or a data breach, and is trying to sign in.
- Occasionally, it’s an innocent cause: an old device or app trying to reconnect, or a family member using a shared account.
Treat it as a warning until you know otherwise.
Why attackers send lots of prompts
This is called MFA fatigue or push bombing. Attackers trigger prompt after prompt, sometimes late at night, hoping you’ll approve one by accident or out of frustration. Sometimes they follow up with a call or message pretending to be IT support, saying you need to approve the prompt to fix a problem.
No genuine IT team, bank or company will ever ask you to approve a sign-in you didn’t start.
What to do
Deny the prompt, or ignore the code
Never approve it, and never read out or forward a code.
Change the password
Go to the real website or app yourself and change the password for that account. If you use the same password anywhere else, change it there too.
Sign out everywhere
Use the account’s security settings to sign out of other sessions and remove devices you don’t recognise.
Check for changes
Look for new recovery emails or phone numbers, email forwarding rules, or connected apps you didn’t add. See what to do if your email is hacked.
Tell your workplace
If it’s a work account, contact IT immediately. They can reset your password, revoke sessions and check what the attacker tried to do.
If you approved one by mistake
Act straight away: change the password, sign out all sessions and, for work accounts, call IT now. Approving once isn’t the end of the world if you move quickly.
Making prompts harder to abuse
- Number matching. Microsoft Authenticator asks you to type a number shown on the sign-in screen, which you can only see if you’re the one signing in. Many other apps offer similar checks.
- Passkeys and security keys can’t be approved remotely by mistake, because they only work on the device in front of you. See our passkeys guide.
- Location and app details shown in the prompt help you spot sign-ins you didn’t start. Read them before you tap.
For businesses
- Make sure number matching is on in Microsoft 365 and similar settings are on in other platforms.
- Move admin and finance staff to passkeys or security keys.
- Tell staff clearly: deny unexpected prompts and report them, and IT will never ask them to approve one.
- Set up alerts for repeated failed MFA attempts so you can respond quickly.
Common questions
I got a single code by text and nothing else happened. Should I worry?
Someone may have entered your phone number or email on a sign-in or password reset page. It could be a mistake, but changing the password and checking the account is a sensible precaution.
The prompts keep coming even after I deny them.
Change the password. Once the attacker no longer has the right password, the prompts stop.
Is MFA pointless if this can happen?
No. MFA is the reason the attacker can’t just walk in. Denying the prompt is MFA doing its job.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.