What to Do About an Unexpected or Suspicious Duo Push
What to Do About an Unexpected or Suspicious Duo Push
An unexpected Duo Push can mean that someone entered your password, a sign-in session was triggered without your knowledge, or an automated process behaved unexpectedly. Treat it as a possible security incident. Approval completes the second factor, so never approve simply to make repeated notifications stop.
Respond immediately
- Do not approve the request. Read the application, location, device, and time details shown, if available.
- In Duo Mobile, deny the request. If Duo offers an option to report it as fraudulent or says No, this wasn’t me, select that option when the request truly was not yours. Duo’s Universal Prompt guidance states that using its “not me” reporting option notifies the Duo administrator of fraudulent activity.
- Stop initiating new sign-ins until you can distinguish your own attempts from the suspicious one.
- Contact Zerolimit through a known support channel and report the approximate time, application name, displayed location, and how many requests appeared.
- Change your work password through the organization’s official password-change page, especially if you may have entered it into an unexpected page. Use a new, unique password. If you are unsure of the correct page, ask Zerolimit for the address without sharing the old or new password.
If you accidentally approved an unexpected request, contact Zerolimit immediately and state clearly that it was approved. Do not wait to see whether anything else happens. Sign out of active sessions if the normal account portal offers that function, but do not delay the report while investigating on your own.
Recognize push-based social engineering
Attackers may send repeated requests, then call or message while pretending to be IT support. They may claim that approval is required to stop the alerts, repair email, confirm your identity, or complete an upgrade. These are warning signs. Zerolimit will not ask you to disclose your password or a Duo passcode, and will not ask you to approve a push that you did not initiate.
A legitimate push should follow a sign-in you just started. For verified Duo Push, the prompt may show a short code that you enter in Duo Mobile or ask you to confirm details. Match those details only to the sign-in in front of you. Never repeat a verification code to a caller or type a code supplied by someone else.
A location can be approximate because of network routing, mobile carriers, or VPN use, so location alone is not proof. The strongest check is whether you initiated that exact login to that exact application at that time. When in doubt, deny.
Preserve useful information safely
Write down the approximate time, application shown, location, device information, number of prompts, and whether you denied, reported, or accidentally approved. A screenshot may help if it does not expose a passcode, activation QR code, recovery secret, or other sensitive information. Do not keep reopening the request just to gather evidence.
Do not uninstall Duo Mobile, delete the organization account, clear the phone, or remove security controls unless Zerolimit directs you through an approved recovery process. Those steps can destroy a working authentication method without securing the underlying account.
If the request might have been yours
A push can be delayed. Think about whether you recently signed in, unlocked a computer, connected a remote-access client, or retried an application. If you cannot confidently match the request to your action, deny it. You can then close the original browser or application, reopen it from a known address, and make one fresh sign-in attempt. Approve only the new request whose timing and application details match.
When to stop and contact Zerolimit
Contact Zerolimit immediately after any fraud report, any accidental approval, repeated unexpected requests, a suspicious support call, an unfamiliar application, or a password entered into a questionable page. Also contact Zerolimit if Duo marks the account locked or disabled after you deny a request. Provide the factual details above and remain reachable through your organization’s approved channel. Never provide your password, current or past MFA codes, an activation QR code, a recovery secret, or approval of a push for support.
Support safety reminder: Zerolimit will never ask you for your password or an MFA code.