What you’re seeing
- Microsoft Authenticator or Duo push notifications arrive when the employee is not signing in to anything.
- Prompts come in bursts, sometimes late at night or several in a row within minutes.
- Sign-in logs show attempts from foreign countries or unfamiliar devices around the same time.
- An employee admits they approved one of the prompts just to make the notifications stop.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The employee's password was stolen in a phishing email, a data breach at another site or by malware.
- Attackers are deliberately flooding prompts, hoping the user taps Approve out of annoyance or confusion.
- The MFA method is a simple approve button without number matching or location details.
- Legacy authentication or a misconfigured app on another device is retrying with an old password, causing harmless but confusing prompts.
Why it matters
An unexpected MFA prompt usually means the password is already in an attacker's hands, and MFA is the last thing standing between them and the mailbox. One mistaken approval can lead to invoice fraud, payroll redirection, data theft or phishing sent to your customers from a trusted address. Business email compromise is among the costliest crimes reported to the FBI, and small businesses are frequent targets.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
What should the employee do right now?
Deny every prompt they did not start and report it right away. The password should be treated as compromised and changed, and if a prompt was approved, the account needs to be reviewed for unauthorized access.
Can you check whether the attacker got in?
Yes. A certified US engineer can review sign-in activity and mailbox rules with you in a remote secure session, starting from $99, and you pay only when the issue is resolved.