Attackers don't always break in. Sometimes they ask.

What actually happens

With a stolen password, an attacker can send approval requests to your phone over and over, often late at night, until someone taps Approve to make them stop.

Others pick up the phone. They pose as an employee to get the help desk to reset a password, or pose as the help desk to get an employee to read out a code or approve a request.

Both tricks depend on someone acting without checking. Sign-in prompts that ask you to type the number shown on screen stop blind approvals, and a help desk that confirms who it is talking to stops the calls.

What you can do today

• Never approve a sign-in request you did not start. Deny it and tell IT.
• If someone calls saying they are from IT, hang up and call back on a number you already know.
• Never read a sign-in code to anyone, including someone who says they are from IT.