Your phone asks you to approve a sign-in while you are making lunch. You are not logging in anywhere. The safest interpretation is not that the app is being annoying: it is that someone or something is attempting an authentication step you did not request.
Do not approve the prompt to make it disappear. An unexpected request does not prove every part of the account has been compromised, but it is a reason to investigate deliberately.
Keep the investigation separate from the prompt
Reject the request using the app’s legitimate controls. Open the service through its known app or a trusted bookmark, rather than a link in an accompanying email or message. Review recent sign-ins and security notifications there.
If this is a work account, contact the organisation’s security or support team through its established channel. Report the time and account involved. Do not send passwords, recovery codes or screenshots containing one-time codes to an unsolicited “support” contact.
Repeated requests can be a pressure tactic
CISA’s guidance on number matching describes the risk of push-notification fatigue. Number matching improves on a simple approve button by requiring a correspondence with the sign-in screen, but a request you did not initiate should still be rejected.
Neither repetition nor urgency makes a login legitimate. A caller claiming to be the help desk does not change that. End the unsolicited interaction and contact support independently if you need confirmation.
Review the account, not just its password
Follow the provider’s recovery guidance if you see unfamiliar access. Depending on the service, useful checks include active sessions, recovery addresses, registered authentication methods and connected applications. An unexplained recovery method deserves attention even after a password change.
Use the provider’s own instructions to revoke unfamiliar sessions and secure the account. If you cannot establish control, use its official recovery process. For an organisation, preserve relevant details for the response team rather than experimenting with settings that could erase useful evidence.
Improve the next login
Where supported, consider phishing-resistant authentication such as appropriately configured security keys or passkeys. Keep recovery arrangements secure and current; stronger login protection is less useful if the recovery route is neglected.
A useful personal rule is simple: an approval belongs to a sign-in you are actively performing and recognise. If those two events do not line up, pause. The few minutes spent checking through a trusted route are preferable to granting access merely to quiet a notification.