Learn how that quick extra step at sign-in keeps your account safe, how scammers try to trick you with it, and what to do when a pop-up or code shows up out of nowhere.
Only approve a sign-in pop-up when you started signing in yourself. Never read out or share the code you get.
Last reviewed 2026-06-17 by the IT Lunchroom Editorial Team. General guidance, not professional security or legal advice.
I can tell when an MFA prompt is expected, when it may be an attack, and how to respond safely.
You leave with a simple way to tell whether a pop-up is really from you, plus a quick habit you can lean on every time you sign in.
MFA is just one quick extra step when you sign in. After your password, the service double-checks it's really you — usually by texting a short code to your phone, or showing a pop-up that asks you to approve the sign-in. That extra step is what stops someone who only stole your password.
A pop-up you didn't start can mean someone else already has your password and is just waiting for you to approve the sign-in so they can get in.
Check that the pop-up matches a sign-in you just started — it should name the same app or account you were trying to open. If it names something you don't recognize, or you weren't signing in at all, say no, never share or read out a code, and tell whoever handles tech where you are.
Practice lets you tell the pop-ups you were expecting from the ones that should make you pause — all without touching a real account.
You'll write a short note to yourself: when you'd approve a pop-up, when you'd say no, and who you'd tell about anything you didn't expect.
When it matches a sign-in you just started. Your own sign-in is the safest thing to trust — not how urgent or well-timed a pop-up feels.
Keep it private. A code is the key to your account. Your note should describe what you'd do — never the code itself.
Someone may be trying to access the account. A sign-in pop-up you didn't expect is a warning sign. Saying no and telling whoever handles tech keeps the account safe.
Deny the prompt, do not share any code, and use the approved support or reporting route. A prompt that does not match your own action deserves a safe stop.
Write a short routine that says when you approve, when you deny, and where you report unexpected prompts. Good evidence proves judgment while keeping sensitive information out of the note.
Do the hands-on version of this lesson, then create a free account to save your progress. Finish a whole track and you earn a shareable certificate you can add to a résumé or job application. No payment, no catch.
We use cookies for basic analytics to improve these free lessons. See our Privacy Policy.