Camille grabbed her phone off the nightstand before her alarm even stopped. Same as every morning. A quick check of email, a glance at her banking app, and a tap to approve a Microsoft 365 sign-in notification before she even got out of bed.
She had not thought twice about it. The notification looked normal. She approved it. What she did not know was that someone had been trying to log into her work account since 3 a.m. That approval was not her session. It was theirs.
Her phone was not stolen. It was not hacked. She had simply tapped "Approve" out of habit, half asleep, without reading what she was approving.
Camille approved a multi-factor authentication (MFA) prompt she did not request. Attackers use a technique called MFA fatigue. They send repeated login requests hoping the user will approve one just to make it stop, or in Camille's case, approve one automatically out of routine. Her phone did not fail her. Her habit did.
Your phone is connected to almost everything. Email. Banking. Work accounts. Password resets. MFA approvals. Whoever controls your phone controls access to most of your digital life.
A compromised phone does not just affect you at work. It can expose your bank accounts, personal email, social media and any account that sends verification codes to your number.
Never approve an MFA prompt you did not trigger yourself. If you did not just try to log in, deny it and report it.
Set your phone to lock automatically after 30 seconds or one minute of inactivity.
Use a strong PIN, password or biometric lock. Avoid simple patterns or four-digit codes that are easy to guess.
Turn off lock screen notifications that show message content. Verification codes should not be visible without unlocking the phone.
At work, treat your phone as a work device when it receives work-related MFA prompts. The same caution applies.
✔ Open your phone settings and confirm your screen locks automatically in 30 to 60 seconds.
✔ Check that your lock screen does not display the full content of text messages or notifications.
✔ If you use an authenticator app for work, make sure the app itself requires a PIN or biometric to open.
I only approve MFA prompts I personally triggered.
My phone locks automatically within one minute.
My lock screen does not display sensitive notification content.
I use a strong PIN or biometric to unlock my phone.
I know to report unexpected MFA prompts to IT immediately.
Before you tap "Approve" on any login notification, ask yourself one question: Did I just try to log in? If the answer is no, deny it and report it.