Do not approve the request
If your authenticator asks you to approve a sign-in you did not start, select Deny if available. Never share a verification code with someone calling or messaging you, including someone claiming to be support.
Tell security promptly
- Report the time of the prompt and the account or app it named.
- Mention if you approved it by mistake, shared a code, or saw repeated prompts. That detail changes the response.
- Use a known support number or your normal help desk channel, not a number in an unexpected message.
Follow the support team's guidance
Your team may ask you to change a password through the established company sign-in page and review active sessions. Avoid guessing which devices to remove on your own. CISA's MFA guidance explains why unexpected prompts matter.