A sign-in prompt you did not ask for: what to do

It is 9:40 on a Tuesday. Marisol is making tea. Her phone buzzes: “Approve sign-in?” She did not try to sign in. It buzzes again. And again.

Then a text arrives: “Hi, this is IT. We are fixing a fault. Please approve the next request.”

That is a scam. Here is why, and what to do.

What is happening when a prompt appears out of nowhere?

Someone probably has your password. They typed it into your work login. The prompt on your phone is the second lock, and they need you to open it.

So they ask. Again and again, at night or when you are busy. Some also call or text and pretend to be IT. This is called MFA fatigue, or push bombing. CISA describes it as bombarding a user with push notifications until they approve one by accident or out of annoyance.

The rule is simple. If you did not just try to sign in, the answer is always Deny.

How does the scammer get your password in the first place?

Often from a fake login page. You get an email, a text or a chat message: “Your mailbox is full. Sign in to keep it.” You click. The page looks right. You type your email and password. The scammer now has them.

Some fake pages go further. They ask for your approval code too, and pass it to the real site at once. That is why a code or a tap is not enough on its own. It is also why the page address matters.

What does a fake login page look like?

Almost exactly like the real one. Do not trust the logo, the colours or the layout. They are easy to copy. Look at these instead:

• The address bar. The real company name should sit right before the first slash, with nothing odd around it. login.northwindmail.example is fine. northwindmail.login-secure.example is not.
• How you got there. Did you click from an email, a text or a chat? Then stop. Open the site yourself.
• The rush. “Your account will close in 24 hours.” Real companies rarely work like this.
• What it asks for. A login page that also asks for your card number, your date of birth or a code from a text message is a red flag.

The CISA guide to spotting phishing lists the same signs: urgent language, a request for personal or financial information, links that hide where they go, and addresses that copy real ones.

A habit that beats this trick: save your work sign-in page as a bookmark, and only use the bookmark. Or use a password manager. A password manager will not fill in your password on a lookalike address, which is a free warning.

What if you tapped Approve, or typed your password on a fake page?

Do not hide it. Speed is the thing that matters.

1. Tell IT or your manager right now. Say what you saw and when.
2. Change your password from the real site. Change it anywhere else you used the same one.
3. Ask IT to sign you out of all devices and review recent sign-ins.
4. Check your inbox rules. Attackers often add a rule that forwards or hides mail. Ask IT to check.
5. Warn the people close to you if odd messages went out from your account.

Our guide to what to do after clicking a phishing link has the full first-hour list. In Nigeria, if the account held personal data of customers or staff, see what staff do in the first 72 hours of a breach.

What can your company do to make this harder?

This part is for managers and IT, but staff should ask for it.

• Turn on number matching so staff have to type a number into the app. CISA recommends this as an interim step while you move to stronger sign-in.
• Move to phishing-resistant sign-in such as security keys or passkeys where you can. CISA’s guidance on multifactor authentication is a good start.
• Make sure staff know who to call, and that IT will never ask them to approve a prompt they did not start.

Keep reading

This is one of three guides on phones and sign-ins. The others are how to check a QR code before you scan it and AI voice scam calls from the boss, the bank or family. For emails that lead to fake pages, see how to spot a fake email.

Try it safely

Want to know if your team would click a fake login page? Our free phishing test sends made-up phishing emails to up to 25 staff and shows who clicked. Or see how phishing simulation training works.