Your phone buzzes: "Approve sign-in?" You are not signing in to anything. It buzzes again. And again. Late in the evening, tired of it, you tap Approve to make it stop. That tap is the whole attack.
In short
A prompt you did not cause means someone else already has your password.
Never approve to make prompts stop. Deny, report, change the password.
Nobody genuine will ever ask you to read out a security code.
Why the extra step exists
Multi-factor authentication, or MFA, means proving who you are with something extra as well as your password, usually a prompt or a code on your phone. It is the single most effective control you can switch on.
An attacker with your exact password, typing it in from the other side of the world, still gets nowhere. The login stops at a prompt only your phone can answer. It is why a stolen password is an inconvenience rather than an incident.
The prompt you did not ask for
Attackers have learned to go after the human side instead. They send prompt after prompt and wait for you to tap yes. They call it fatigue, and the plan is exactly that you approve one to make them stop.
An approval prompt when you are not logging in: deny it.
Several in a row: deny them all, then report it.
A call or message claiming to be IT, asking you to approve one "to fix an issue": that is the attack too.
An unexpected prompt is not noise. It is news: your password is in someone else's hands, and the prompt is the only thing still holding the door. Change that password the same day.
Codes are secrets
A caller says they are from your bank's fraud team. To "verify you", they ask you to read out the six-digit code that has just arrived by text.
That code was the attacker logging in as you. Reading it out completes their login. No bank and no IT provider will ever ask to hear a security code. If a caller asks for one, the call is the attack. Hang up, and ring the organisation back on a number you already have.
Switch it on everywhere
MFA is the seatbelt. It only works if it is on before the crash, and it needs to be on everywhere that offers it. Start with email, because email can reset everything else.
Not sure where yours is switched off?
We check every account, switch MFA on properly, and set up alerts for the sign-ins that should never happen. Talk to us, or read about managed IT services.