WhatsApp

How to Respond When an Employee Reports a Suspicious MFA Prompt

11/10/2026

An unexpected approval request can signal password compromise, push fatigue, or a misconfigured sign-in.

Checks to make

Tell the user to deny and report the prompt, capture time and application details, review sign-in and MFA logs, and revoke sessions or reset credentials according to response policy if evidence warrants. Verify the report through a trusted channel.

When to get help

Security operations can investigate identity signals and tune MFA protections. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.