Do not approve the login you did not start

Your phone asks you to approve a sign-in while you are doing something else. Then it asks again. Repeated requests are not a reason to tap yes. Only approve a login you started and can match to the service you are using.

Deny unexpected prompts. Open the service through your usual app or saved address rather than a link in a follow-up message. Review recent sign-ins and secure the account if anything is unfamiliar. For a work account, tell the person responsible for security so they can investigate.

Some authentication apps ask you to match a number displayed on the sign-in screen. That helps distinguish a login you initiated, but it is not an invitation to approve a number supplied by a caller. Where supported, ask about phishing-resistant sign-in methods such as security keys or passkeys.

Keep multifactor authentication on. The improvement is to make approvals deliberate and investigate the surprise, not remove the extra protection because an attacker made it inconvenient.