An approval request appears on your phone, but you are not trying to sign in. Then another arrives. This may be an attempt to wear you down until you press Approve. The technique is often called MFA fatigue. MFA means multi-factor authentication: an extra identity check after your password.
Understand the idea
The important question is whether you started the sign-in. A familiar company name on the notification does not make the request yours. A follow-up caller may claim to be support and ask you to approve it. Check with your real support team through a contact route you already know.
- Prompt
An approval request appears without your sign-in.
- Decision
Reject it and use a known route to check the account.
- Recovery
Review sessions and credentials with your support team.
A practical example
Imagine a volunteer receiving repeated prompts during a meeting. A caller says approving one will stop the problem. Instead, the volunteer rejects the request and reports it. Support checks recent account activity, ends suspicious sessions, and helps secure the account before the volunteer resumes work.
What to do next
- Deny the prompt. Do not approve it merely to stop repeated notifications. Do not tell a caller a matching number or one-time code.
- Contact support independently. Use the organization's known reporting route, not the number provided by the caller or message.
- Record the time. A screenshot without codes or sensitive data can help responders locate the event. Say whether you approved any request.
- If you approved one, say so immediately. Support should remove the resulting sessions, investigate activity, and help secure the account. Fast reporting is more useful than blame.
How to check the result
Ask support to confirm what was checked, whether any request was approved, and whether unexpected sessions remain. Simply stopping the notifications does not explain whether the account was accessed.
The caller says they are IT and asks me to approve.
Do not approve the request. End the call and contact support through the normal directory or reporting channel. A caller’s explanation does not establish their identity.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
