Beware of phishing attempts via unwarranted multi-factor authentication (MFA or two-step verification) prompts (known as prompt-bombing). Recent observations indicate that phishers may retrieve a valid username/password combination and enter this valid information into an authentication point. The legitimate user receives the MFA prompt via SMS or an authentication app to confirm their login. If the legitimate user confirms the login, the phisher now has access to the legitimate user’s account. 

Note that Information Systems would never ask an employee or student to provide their MFA code to perform any action associated with their account.

Avoid this malicious phishing attempt by always correlating a MFA confirmation request to your specific activity. If you are a recipient of suspicious activity and/or confirmation of a MFA request that does not correlate to your login, decline the prompt, forward the suspicious text or email to the Information Systems Security Team at infosec@wfu.edu for further analysis, and then delete the message.