Week two of our October habits for staff. This one takes about two seconds.
Your phone buzzes. The authenticator app wants you to approve a sign-in. You’re not signing in to anything. You’re in a meeting, or making dinner, or asleep.
What that prompt actually means
Multi-factor authentication works by asking for two things: your password, and proof that it’s really you, usually from your phone.
The approval prompt only appears after the password part has been done. So a prompt you didn’t start usually means someone, somewhere, has just typed in your password.
That’s not as rare as it sounds. Passwords leak in data breaches all the time, often from websites you signed up to years ago. This year, at one of our client businesses, monitoring flagged that a staff member’s current password had turned up in a breach, and we changed it. Without that monitoring, nobody in the business would have known.
Why people press Approve
Because the prompt keeps coming back. Some attackers send prompt after prompt, late at night or in the middle of a busy day, hoping you’ll tap Approve just to make the buzzing stop. Others count on you assuming it’s a glitch, or thinking it must be your laptop checking in.
Approving it doesn’t make the problem go away. It hands them your account, with your email, your files and everything you can reach at work.
The one habit
If you didn’t start the sign-in, press Deny. Then tell IT the same day so your password can be changed.
Denying stops that attempt. It doesn’t stop the person who has your password from trying again, which is why the second half matters just as much.
A few things that make it easier
- If the app shows a number and asks you to match it, and there’s no screen in front of you showing that number, that’s your answer. Deny.
- If you’re not sure whether it was you, deny anyway. If it was you, you’ll simply be asked again when you try to sign in.
- If the prompts keep coming, don’t wait until morning. Ring IT, or change your password yourself if you know how.
- Say if you approved one by mistake. Tell IT straight away. It’s fixable if they know quickly.
A denied prompt and a quick message to IT is a good outcome. It means the second layer did exactly what it’s there for.
Next week, habit three: checking the sender before you ask for an email back from quarantine.
If your business still has accounts without multi-factor authentication switched on, talk to us about fixing that first.