An MFA request on your phone means someone has entered your password and is trying to sign in as you. If that someone wasn't you, this article explains what to do.
Never approve a sign-in request you didn't start, even if the prompts keep coming. Select Deny (or No, it's not me) and call synfo on 1300 079 636.
Why it happens
The most common reasons are:
- Someone else has your password. They may have got it from a phishing email, a fake sign-in page or a data breach on another website where you used the same password.
- They're hoping you'll tap Approve. Attackers sometimes send prompt after prompt, late at night or during a busy moment, hoping you'll approve one to make them stop.
Occasionally there's an innocent explanation, such as an old device or app still trying to sign in with your account. Don't assume that, though. Let us check.
How number matching protects you
When you sign in, Microsoft usually shows a number on the screen you're signing in from. The Authenticator app asks you to type that number in before it approves.
If a prompt asks for a number and you're not looking at a sign-in screen showing one, you didn't start it. That's a clear sign to deny. Depending on your organisation's settings, the app may also show the app name and an approximate location for the sign-in. A location you don't recognise is another warning sign, although locations can be inaccurate.
What to do right now
- Deny the request. If the app asks whether you recognise it, choose the option saying it wasn't you.
- Don't approve any further prompts. Ignore or deny them all.
- Call synfo on 1300 079 636. We can check the sign-in attempts, sign out other sessions, and help reset your password and MFA.
- Change your password from a device you trust, if we haven't already done it with you. If you used the same password anywhere else, change it there too.
- Follow up by email to support@synfo.com.au with P1 in the subject, so there's a written record.
If you already approved one
It happens, and speed matters far more than embarrassment. Call us straight away and follow what to do if your account is compromised.
Still stuck?
If you're unsure whether a prompt was yours, treat it as suspicious and call 1300 079 636.