Unexpected Login Approval Prompts: What They Mean
Your phone asks "Are you trying to sign in?" and you are not. What an unexpected login approval prompt or code means, what to do right away, and how to stop repeat prompts.
Your phone lights up: "Are you trying to sign in?" Or a verification code arrives by text that you never requested. You are not signing in to anything. This is your two-step verification doing its job, and it is also a warning. In most cases, someone has your password and is trying to get past the second step.
What to do right now
- Deny the prompt, or ignore the code. Never approve or share it.
- Change the password for that account from a device you trust, using the official app or website.
- Sign out of all other sessions in the account's security settings.
- Check recent activity for unfamiliar sign-ins, devices or changed settings.
- Change the password anywhere you reused it. See why password reuse is so dangerous.
If someone contacts you right after the prompt, claiming to be support and asking you to approve it or read out the code, it is a scam. Hang up.
Common versions of this trick
| What you see | What is happening |
|---|---|
| A single "Is this you?" prompt | Someone entered your correct password. |
| Many prompts in a row | MFA fatigue: they hope you approve to make it stop. See MFA fatigue attacks. |
| A code by text you did not request | Someone is trying to sign in or reset your password. |
| A WhatsApp registration code | Someone is trying to register your number on their phone. |
| A call from "support" about the prompt | Social engineering to get you to approve or share the code. |
If you approved it by mistake
Act immediately: change the password, sign out all sessions, remove unknown devices, check recovery details and forwarding rules, and warn contacts if the account can message people. Our guide on your first hour after an account takeover has the full steps.
Reduce the chance it happens again
- Use a unique password for every account, stored in a password manager.
- Switch to number matching or passkeys where offered. Passkeys resist phishing. See what is a passkey.
- Turn on sign-in alerts so you notice activity quickly.
- Report repeated prompts on work accounts to your IT team.
Got a message about a login you did not make? Paste it into CyberWatch AI Scan for a free check, and open the account yourself to review activity.
For more, read our guide on how to protect your accounts.
Frequently asked questions
Does an unexpected prompt mean someone has my password?
Very often, yes. The prompt usually appears after the correct password has been entered. Deny it and change your password straight away.
What if I approved it by accident?
Change your password immediately, sign out of all sessions, check for changed settings, and follow our first-hour guide for account takeovers.
Why do I keep getting prompts over and over?
Attackers sometimes send repeated prompts hoping you will approve one to make them stop. This is called MFA fatigue. Do not approve; change your password to stop them.
Sources
- Multifactor Authentication, US Cybersecurity and Infrastructure Security Agency
- Received verification code without requesting it, WhatsApp Help Center
- Recovering a hacked account, UK National Cyber Security Centre
