Security · Fix-itDraft

Getting MFA prompts you didn't ask for?

Draft. Not published yet.

Your phone lights up with a Microsoft Authenticator approval, a number to enter, or a text with a security code, and you weren’t signing in. Don’t approve it. Don’t type the number. Don’t share the code with anyone who calls or messages you about it.

An unexpected prompt often means someone is trying to sign in as you. In many cases they already have the password and are hoping you’ll tap Approve just to stop the notifications. That’s sometimes called MFA fatigue. Treat it as a warning, then lock the account down.

If this is a work or school account, tell your IT admin as soon as you’ve denied the prompt. They can see sign-in attempts and revoke access in ways you may not be able to.

1. Deny the prompt, every time

On the Authenticator notification:

  1. Choose Deny or No, it’s not me if you see that option.
  2. If the app asks you to enter a number, don’t enter it unless you are looking at a sign-in screen you started yourself. Microsoft’s number matching feature is meant to stop you from approving a stranger’s sign-in by accident.
  3. If there’s a way to report the request as suspicious, use it.
  4. Don’t approve a prompt to “make them stop.” That’s the reaction the attacker wants.

The same rule applies to a text or email code: if you didn’t just try to sign in, don’t use that code and don’t read it out to anyone.

A single unexpected text code can also happen when someone typed your phone number or email by mistake. Still don’t share the code. Then check recent activity in the next steps so you’re not guessing.

2. Change the password from a device you trust

Use a computer or phone you already use for this account, not a link from an email or text about the prompt.

  1. If you can, run a full scan in Windows Security first (Virus & threat protection > Scan options > Full scan). Microsoft recommends scanning before you change a password on a PC that might have malware.
  2. For a personal Microsoft account, sign in at account.microsoft.com/security and change the password. Use a new password you don’t use anywhere else.
  3. For a work or school account, change the password the way your organization normally does, or start from mysignins.microsoft.com/security-info if you’re allowed to. If you can’t change it, tell IT right away.
  4. If you reused that password on other sites, change those too.

If you can’t sign in, the password may already have been changed. Use the official “Forgot my password” or account recovery flow, or ask your admin to reset it. Don’t call a number from the unexpected prompt.

3. Review recent sign-ins and sign out everywhere

For a personal Microsoft account:

  1. Open Recent activity from your Security basics page. Microsoft lists activity from the last 30 days.
  2. Expand anything you don’t recognize. In Unusual activity, choose This wasn’t me. In Recent activity, choose Secure your account if something looks wrong.
  3. Check whether security info changed: a new phone number, a new authenticator, or a new email for recovery. Remove anything you didn’t add, after you still have a way to sign in.
  4. Use Sign out everywhere in your Microsoft account’s additional security options. Microsoft says this can take up to 24 hours to take effect on browsers and apps. Xbox is a separate sign-out.

For a work or school account, review mysignins.microsoft.com and tell IT what you see, including the time of the prompts. Ask them to revoke sessions and check whether a new MFA method was added.

4. Check email forwarding and extra sign-in methods

If the attacker got in even briefly, they may have added a mailbox rule or a new way to approve sign-ins.

  1. In Outlook on the web, open Settings and check Mail forwarding and Rules. Turn off forwarding you didn’t set up and delete rules you didn’t create.
  2. On your security info page, look at every sign-in method. Keep ones you still use. Remove old phones, unknown authenticators, and app passwords you don’t recognize.
  3. If you use passwordless sign-in or allow push approvals, consider adding a method that’s harder to socially engineer, such as a passkey, if your account supports it. For a work account, ask your admin what’s approved.

5. Watch the account for a few days

Keep denying any prompt you didn’t start. If the prompts continue after the password change and “sign out everywhere,” tell IT (work account) or go back through recent activity and security info (personal account). An attacker who still has a session or a leftover MFA method can keep trying.

If you get emails about unusual sign-ins, don’t click links in those messages. Open the official security page by typing the address yourself.

What this usually means (and what it doesn’t)

Repeated Authenticator approvals you didn’t start are a strong sign that someone is attempting to sign in as you. Often they have the password. It does not automatically mean they already got in. MFA is doing its job when you deny the request.

A code you didn’t request, with no unusual sign-ins in recent activity, can also be a typo or a leftover attempt that didn’t succeed. You should still deny it and check the account. Don’t ignore a pattern of repeated prompts.

What not to do

  • Don’t approve a prompt because the notification says the sign-in is from a familiar city or app. Attackers can spoof details or use a VPN.
  • Don’t type a number from a prompt into Authenticator unless you initiated that sign-in and you can see the matching number on your own sign-in screen.
  • Don’t reset MFA by removing your only authenticator until you have another working sign-in method, or you can get locked out.

Still stuck?

If the prompts won’t stop or you can’t get back into the account, I can help remotely. Support is after-hours, nationwide, with local help in the Dallas–Fort Worth area. Details are on the Work with me page.

Sources checked