Scam library
Unexpected sign-in approval requests (MFA fatigue)
Sign-in prompts you didn't ask for, and why tapping Approve can let someone in.
Short answer
An MFA fatigue attack sends sign-in approval prompts to someone whose password was stolen, hoping they'll tap Approve to make the prompts stop.
How it works
Multi-factor sign-in, where your phone asks you to approve a login or gives you a code, is one of the best protections there is. That's why scammers try to get around it.
If someone already has your password, they'll try to sign in and hope you approve the prompt on your phone. Some send prompt after prompt, late at night, until you tap Approve just to make it stop. Others call or message pretending to be IT and ask for the code.
The rule
Only approve a sign-in you started yourself, a few seconds ago. An unexpected prompt means someone has your password.
Red flags
- A sign-in prompt you didn't start.
- Several prompts in a row.
- Anyone asking you to read out or approve a code for them.
What to do
Tap Deny, then tell your IT provider right away. They'll change your password, because an unexpected prompt means someone already knows it.
This page is taken from the 2 minute NetMinder lesson staff see straight after clicking a practice email about this scam.