Unexpected MFA Prompts: Deny, Secure, and Escalate
Unexpected MFA Prompts: Deny, Secure, and Escalate
A multi-factor authentication (MFA) prompt is expected only when you are actively signing in or performing a protected action. An unexpected approval request, verification code, phone call, text message, or number-matching screen can mean someone already knows your password and is trying to finish the sign-in. Repeated prompts may be an “MFA fatigue” attack: the attacker hopes annoyance, confusion, or a convincing phone call will make you approve one.
Take these steps immediately
- Deny or reject the prompt. If the app offers “Report suspicious activity,” use it. Never approve a request simply to make notifications stop.
- Do not share a code or number. Zerolimit, Microsoft, Google, and legitimate support personnel will not need you to read them an MFA code so they can “block” an attack. Do not enter a number supplied by a caller into your authenticator.
- Stop any sign-in you did not start. Close the unexpected page or call. Do not click links in an alert message to investigate.
- Contact Zerolimit immediately through a known channel. Explain when the prompt appeared, which account or app it named, whether prompts are repeating, and whether you approved any request.
- Keep the device connected and available unless Zerolimit tells you otherwise. Do not uninstall the authenticator, remove the account, reset the phone, or erase alerts; those steps may slow containment.
Microsoft’s number-matching guidance explains that Authenticator may display a number, application name, and sign-in location to help a user understand the request.[1] These details are clues, not guarantees. Location can be approximate, and an attacker can imitate a familiar service. The deciding question is simple: Did you initiate this exact sign-in right now? If not, deny it.
If you accidentally approved
Treat the account as potentially compromised. Contact Zerolimit at once and say clearly that you approved an unrecognized MFA request. Do not wait for an email alert or visible account changes. Zerolimit may revoke active sessions, reset credentials, review sign-in records, and confirm that registered authentication methods have not been changed.
If directed, change the password from a known-good device by typing the organization’s normal sign-in address yourself or using a trusted bookmark. Use a new, unique password that is not used anywhere else. Do not use a reset link from the suspicious message or caller. If the same password was reused on any personal service, change those passwords separately, beginning with the associated email account.
Tell Zerolimit if you disclosed a password, verification code, backup code, screen image, or personal details. Also report any phone call in which someone claimed to be support, a vendor, a bank, or an executive and instructed you to approve a prompt. That social-engineering context may help protect other employees.
If prompts continue
Continue denying them, silence the phone only if necessary for safety or concentration, and keep a note of the times. Do not engage with a caller who claims the prompts will stop after one approval. Zerolimit may ask you to temporarily stop using the affected account or device while containment is underway.
MFA remains an important protection. One suspicious prompt does not mean MFA has failed; it may be the control that stopped the attacker. Do not disable MFA or switch to weaker verification on your own. Microsoft recommends two-step verification as an additional barrier when a password is exposed, and Google’s account-security guidance similarly recommends reviewing security events and using two-step verification.[2][3]
What to send Zerolimit
Provide the affected username, approximate time, app or service shown, device receiving the prompt, and whether you denied, reported, or approved it. A screenshot is useful if it can be captured without accepting the request, but speed is more important than documentation. Do not reproduce the event or attempt another sign-in merely to collect evidence.