You did not start a sign-in or account-change action
There is no reason to approve an authentication request you did not initiate. Denial is the safe immediate decision even before the cause is known.
Phishing guide
What is MFA fatigue, and what should I do with an unexpected authentication prompt?
Respond safely to unexpected MFA push notifications, authentication codes, and repeated approval requests.
Content reviewed
Short answer
Deny an authentication prompt you did not initiate. Do not share a code or approve a request to make it stop. Open the account’s security activity independently and report repeated prompts through a known support channel.
01
What you may be seeing
An unexpected prompt can mean someone entered your username and password, a saved session is reconnecting, an application is misconfigured, or another benign or malicious event occurred.
Repeated prompts can pressure a person into approving one. CISA’s multi-agency guidance recommends controls such as number matching to reduce this pattern.
02
Signals to inspect—and why they matter
Strong evidence
A caller or message asks you to read back a code or approve a prompt
The code or approval is the authentication factor. Sharing or approving it can complete someone else’s sign-in.
Contextual signals
The displayed location looks unfamiliar
Location can be imprecise. The uninitiated prompt is the stronger signal; use account activity and support logs for investigation.
Contextual signals can justify caution, but they do not authenticate or condemn a message by themselves.
03
Safe verification steps
- Select Deny when the authenticator offers it; otherwise let the prompt expire.
- Open the service from a known app or bookmark and review recent security activity.
- For a work or school account, contact IT/security through the directory or normal help channel.
- If activity suggests the password is known, change it through the official service and replace any reused password.
04
What to do next
Evidence
Authoritative references
- CISA, NSA, FBI, MS-ISACPhishing Guidance: Stopping the Attack Cycle at Phase One
- Microsoft SupportView your work or school account sign-in activity from My Sign-ins
- Microsoft SupportProtect yourself from phishing
Reporting instructions on linked pages belong to the named organization. Baitaphish does not receive or process reports.
Limitations and uncertainty
What this guide cannot establish
- An unexpected prompt does not, by itself, prove that a password was stolen or that a sign-in succeeded.
- Prompt wording and controls differ across authenticator products and organization policies.