Unauthorised requests

Question

Hi

I've recently received 3 Authenticator messages for activity not generated by me. I’ve denied them. Is that sufficient or do I need to do anything else to ensure the security of my account and data?

Answer 1

Hey there, Deborah Price

I've recently received 3 Authenticator messages for activity not generated by me.

If you’ve received three Microsoft Authenticator prompts that weren’t generated by you, this usually means someone has manually tried to sign into your account using your email and an incorrect or guessed password. It could also simply be someone mistyping their own email address if it’s similar to yours. Three prompts alone does not indicate a large scale attack such as credential stuffing.

Is that sufficient or do I need to do anything else to ensure the security of my account and data?

Please sign into your Recent Activity page here: https://account.live.com/Activity

Review the sign‑in attempts and check whether they come from the same IP address, the time of each sign-in attempt, the same device type, or completely different locations. This will help determine whether it was a simple mistake or repeated attempts.

Next, go to your security info page: https://account.live.com/proofs/manage/additional

Please make sure you have two-step verification enabled on your account. If you haven't enabled the passwordless account option, please change your account password to a unique strong password. If you have previously setup app passwords, please check these and remove any old app passwords you no longer need.

I would recommend enabling the passwordless sign-in option for your account. This removes the password and makes use of the Microsoft authenticator app for signing in, which is more secure. However, this is your choice. You can find out more about the passwordless account option here: https://support.microsoft.com/en-us/accounts-billing/security/how-to-go-passwordless-with-your-microsoft-account

After you have done this, please scroll down to the bottom the page until you come the heading "Recovery code"

Please click onto the option "Generate a new code"

A personal Microsoft account can only have one recovery code at a time. This recovery code can be used when you no longer have access to any of your security proofs. It is the last line of defence for getting back into your Microsoft account. Please make sure you keep it safe in case you need it.

If these attacks become more frequent, and relentless, then it would mean you are subjected to an attack known as credential stuffing. However, as you have only had three notifications so far, this doesn't suggest this is happening. You can check on have I been pawned, here: https://haveibeenpwned.com/

This service allows you to see if your email address was ever leaked in a data breach. If it has, then it will display the data breach is was leaked in, and what information they had access to. The best thing about the website is, it is free.

Lastly, never approve an authenticator prompt unless you are actively signing in. Declining unexpected prompts protects your account even if someone has your password.

Hope this helps,
Nathan

Answer 2

Denying unexpected prompts is correct, but more steps are recommended to secure the account.

1. Check recent sign-in activity
   • Go to the Recent activity page at https://account.live.com/Activity.
   • Review sign-ins for the last 30 days. Expand any event that looks unfamiliar.
   • If there is an Unusual activity section, mark entries as This wasn't me where appropriate and follow any Secure your account prompts.
2. Secure the account if anything looks suspicious
   • From the Security basics or Security settings pages, immediately change the password to a strong, unique one and do not reuse it on other sites.
   • On the Recent activity page or Security settings page, use options such as Secure your account and remove all trusted devices if available.
3. Treat unrequested prompts/codes as possible attack attempts
   • Unrequested prompts or verification codes can mean:
     1. Someone is trying to access the account.
     2. Someone mistyped a phone/email when signing in.
     3. A previously requested prompt/code was delayed.
   • Continue to deny any sign-in requests that were not initiated.
4. Strengthen sign-in going forward
   • Ensure strong multi-factor authentication is enabled (for example, Microsoft Authenticator or other secure methods).
   • Consider going “passwordless” where supported, using methods like Authenticator, Windows Hello, or security keys for stronger protection.

If access issues or suspicious activity persist after these steps, repeat the Recent activity review and password change, and consider contacting Microsoft Support via the official support channel.

---

References:

• Using Outlook mobile to sign in
• Common problems with two-step verification for a work or school account
• What happens if there's an unusual sign-in to your account
• What is the Recent activity page?
• Check the recent sign-in activity for your Microsoft account
• Help protect your Outlook.com email account