Practical guide
Do Not Approve a Sign-In You Did Not Start
Use the context of a verification prompt to decide whether it belongs to your own account action.
Match the prompt to an action
A verification request should connect to something you are doing, not merely to an account you recognize. Suppose your phone asks you to approve a sign-in while you are reading an unrelated page. The familiar service name does not explain who started the request. Do not approve it just to make the notification disappear. Pause, identify your own recent action, and use the account's independently opened security area to investigate anything you cannot match to that action.
Repeated requests do not become permission
Several prompts in a row can make approval feel like the fastest way to stop the interruption. Treat repetition as a reason to step back, not as evidence that the request is genuine. Put the device somewhere you can review it calmly and avoid discussing codes with anyone contacting you at the same time. A person who claims that an approval will cancel an attack is asking you to perform a different action from the one shown on the screen.
Read the request, not the caller's explanation
Verification screens and messages may describe a login or account change. Read that description before acting, even when a caller supplies a reassuring story. For example, a prompt about adding a sign-in method should not be treated as a harmless identity check. The FTC explains that a second authentication factor adds protection beyond a password. Our practical rule is to preserve that separation: the extra factor belongs to your own verified process, not to a stranger's coaching.
Leave a useful incident note
If the activity was not yours, record the approximate time, service, and action shown, without copying the secret code. That gives you a concrete starting point for the provider's account-security process. Review your access from a trusted device and follow the service's official guidance for unfamiliar activity. Avoid claiming that declining one prompt proves the whole account is safe. The immediate success is narrower and important: you did not authorize an action you could not explain, and you preserved enough context to investigate.
Sources checked
Linked reference pages checked on 2026-09-09. Product details can change. No paid-membership test or sponsorship is implied.
FTC: additional account authentication ↗