An MFA prompt you did not trigger is not a nuisance. It fires only after the password has passed, so one unexpected buzz means someone already has it. Push bombing leans on that sequence. An attacker with a stolen password sends prompts until the owner taps approve, by accident or to make the phone stop. Number matching kills the reflex: approval needs the number on the login screen, so you cannot approve a login you cannot see. When a prompt arrives that you did not cause, report it and change that password. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf #CyberSecurity #InfoSec #MFA