Multi-factor authentication (MFA) asks you to prove it is really you when you sign in. That second step might be an app notification, a number to enter, a text message, or a security key. It can stop someone who knows a password from getting into an account, but it still depends on people responding carefully.
If your phone suddenly asks you to approve a work sign-in you did not start, do not approve it. Repeated prompts can be an MFA fatigue attack. Someone may have obtained a password and be trying to wear the user down until one request is accepted. The Canadian Centre for Cyber Security describes this technique and recommends safeguards such as number matching and phishing-resistant authentication.
An unexpected prompt does not prove that an account has been compromised. It could be a mistaken sign-in, an employee using an old device, or an attempted login by someone else. The safe response is the same: reject a request you did not initiate and report it through a trusted channel.
What to do when an MFA prompt appears
Pause before touching the notification. If you are not in the middle of signing in, do not approve it and do not enter a number shown on another screen. Number matching can make push approvals harder to accept by mistake, but it is not a reason to approve a sign-in you did not begin.
- Reject the request. Use the app’s deny or report option if one is available. If it only offers approve, leave it unanswered and contact your IT provider.
- Do not follow links in unexpected messages. Open your normal work app or website yourself if you need to check an account. Do not use a link or phone number supplied by a suspicious text, email, or caller.
- Report what happened. Contact your manager or IT provider using a number, help desk, or contact method your business already trusts. Include the time, account or service named, and whether you received one prompt or several.
- Keep codes private. Never read a verification code to someone who calls or messages claiming to be support. A legitimate support process should not require you to disclose a one-time code.
If you are unsure whether a prompt is legitimate, stop and verify first. It is easier for your IT provider to confirm a real sign-in than to undo an account takeover after an approval.
If you approved one by mistake
Tell your IT provider immediately, even if nothing looks different. Quick reporting gives the administrator a chance to review the sign-in and limit access. Do not assume the request was harmless just because the phone returned to normal.
Use a trusted device and a known route to contact support. Your administrator may need to reset the password, revoke active sessions, confirm that the account’s recovery details are still correct, and remove authentication methods that were not added by the account owner. They may also review email forwarding, mailbox rules, delegated access, and activity in other services connected to the same sign-in.
The exact response depends on the account and sign-in evidence. If the account can access payroll, banking, customer records, or administrator tools, mention that when reporting the incident so the team can assess those risks promptly.
What a business can do to reduce the risk
Business owners can make MFA prompts easier to handle by setting clear expectations before an incident. Staff should know that an approval is only for a sign-in they started themselves, and they should know exactly whom to contact if a request appears unexpectedly.
- Enable number matching for push-based MFA where the service supports it.
- Ask your IT provider whether phishing-resistant options, such as passkeys or security keys, are available for important accounts.
- Prioritise stronger protection for administrator, finance, and business email accounts.
- Use sign-in controls that limit repeated requests where the service offers them.
- Review account access and registered authentication methods when employees join, leave, or change roles.
- Give employees a simple way to report suspicious prompts without worrying that they will be blamed for asking.
Number matching and security keys can reduce certain risks, but no single setting replaces a clear reporting process. MFA is one layer in account security. Password protection, timely software updates, limited administrator access, and a tested response plan still matter.
Make the response routine
A useful team rule is short: if you did not start the sign-in, do not approve it; report it using a known contact method. A manager can include that rule in onboarding and remind staff where to find the help desk number.
Unexpected prompts are worth taking seriously, but there is no need to panic. Reject the request, tell the right person, and let the IT team check the account activity before deciding what to do next.
Sources
- Canadian Centre for Cyber Security: Secure your accounts and devices with multi-factor authentication
- Canadian Centre for Cyber Security: Social engineering
- Microsoft Learn: How number matching works in MFA push notifications
Book a free Business Tech Check.
Choose a time, answer a few quick questions, and Guardian IT Solutions will review your business technology setup before the appointment.
Call/Text: (587) 875-3999 | Email: info@guardianitsolutions.ca
What happens next?
Guardian will review your answers and follow up if anything needs clarification before the appointment.
- Review devices, accounts, backups, and support gaps.
- Talk through what is urgent and what can wait.
- Leave with a practical next-step plan.