Home › Guides

Unexpected MFA prompt? Check your inbox forwarding rules too

By Greg Mitchell · Squared Away Tech · October 14, 2026

Your phone buzzes with a Microsoft Authenticator prompt, or a text asks you to approve a sign-in. You were not signing in. A lot of people tap Approve because they assume Microsoft is just being careful. That is the wrong move.

An unexpected MFA prompt almost always means someone already has your password and is trying to finish logging in. MFA is the last door they need to open. Deny it, change your password, tell whoever handles IT in your office, and then do the second check most small offices skip: look for silent inbox forwarding rules in Outlook.

This guide is a hands-on how-to for those two early-warning checks. It is not a full incident-response playbook. If you already know the mailbox is compromised, start with what to do if a Microsoft 365 account is hacked. If you are still deciding whether something is wrong, see how to tell if your business email was hacked.

Why an unexpected MFA prompt means the password is already stolen

Multi-factor authentication only fires after the password is accepted. If you see a prompt you did not trigger, someone typed your password correctly on a real or fake Microsoft sign-in page. They may have gotten it from a phishing email, a reused password on another site, or a shared front-desk login that never got rotated.

Approving the prompt hands them a session. Denying it keeps them out for that attempt, but it does not revoke the stolen password. They will try again. That is why the next steps matter as much as the deny button.

What to do in the first five minutes

1. Deny or ignore the prompt. Do not approve it “just in case.” If the app asks whether you recognize the sign-in, mark it as you did not.
2. Change your Microsoft 365 password from a computer you trust. Use a long, unique password. Do not email the new password to yourself or a coworker.
3. Tell IT or the office owner immediately. Even a one-person office should write down the time and what the prompt said. If you have cyber insurance, ask whether they want you to call before you dig further.
4. Check your MFA methods under your Microsoft account security settings. Remove any phone number, authenticator app, or security key you do not recognize. Attackers sometimes add their own method so they can get back in later.

Why you also need to check inbox forwarding rules

Changing the password kicks out many active sessions. It does not remove a rule the attacker already created. A common pattern is a rule that forwards or redirects copies of every message, or only messages with words like invoice, payment, wire, or W-2, to an outside address. Another pattern moves client replies into a folder you never open, so you never see someone asking “did you really send this?”

That is how a Bradenton dental office or a Lakewood Ranch bookkeeping firm can change passwords, feel safe, and still have every vendor reply landing in a stranger’s inbox. The MFA prompt was the warning. The forwarding rule is how the attacker stays in the conversation after you shut the front door.

For the bigger picture of tenant gaps that leave this possible, see signs your Microsoft 365 tenant isn’t locked down.

How to check Outlook inbox rules (Outlook on the web)

Use Outlook on the web so you see the same rules Microsoft 365 stores in the cloud, not only rules that live on one desktop. Sign in at outlook.office.com with the account that got the unexpected prompt.

1. Click the Settings gear (usually top right).
2. Open Mail, then Rules. (Path: Settings → Mail → Rules.)
3. Read every rule on the list. Pay special attention to anything that forwards, redirects, deletes, or moves mail, especially to folders like RSS Feeds, Conversation History, or Archive.
4. If you see a rule you did not create, screenshot or write down the condition and action, then delete or turn it off.
5. Still under Mail settings, open Forwarding (sometimes listed near Rules). If forwarding is enabled to any address outside your company, turn it off unless you personally set it up for a known business reason.

Those two screens take most people under five minutes. They catch the silent copies that desktop Outlook alone may not make obvious.

What suspicious rules look like

• Forward or redirect to a Gmail, Outlook.com, or other personal address nobody in the office uses for work.
• Conditions that match payment, invoice, ACH, wire, tax, or HR keywords.
• Rules that mark messages as read and move them so the inbox looks empty of the replies you would expect.
• Rules with vague or blank names, or names that look like system defaults but point outside the company.
• More than one rule doing similar things, as if someone tested and left extras behind.

Legitimate offices do use rules. The test is simple: would you or a coworker have created this, and do you recognize the destination address?

Quick checks after you clean the rules

Still in Outlook on the web, skim Sent Items and Deleted Items for messages you did not send. Glance at your automatic replies and signature. If you are an admin, also review recent sign-in activity for that user and confirm MFA is required for everyone, not only for people who opted in. Small offices in Bradenton, Sarasota, and Lakewood Ranch often share one “office” mailbox or leave old forwarding in place after a staff change. That is exactly where silent rules hide.

A local habit worth keeping

Once a quarter, ask every person who has a Microsoft 365 mailbox to open Outlook on the web and confirm two things: no unexpected MFA methods, and no Mail Rules or Forwarding they do not recognize. It is free, it does not need a new product, and it catches problems while they are still small. Pair it with the free 10-point checklist on the home page if you want a wider pass across sign-ins and admin accounts.

FAQ

What should I do if I get an MFA prompt I did not request?

Deny or ignore the prompt. Do not approve it. Change your Microsoft 365 password from a computer you trust, tell your IT person or office owner right away, and check your Outlook inbox rules and forwarding for anything you did not create.

Does an unexpected MFA prompt mean my account is already hacked?

It usually means someone already has your password and is trying to finish signing in. MFA is what stops them. Treat it as a warning, change the password, and look for hidden forwarding rules even if you denied the prompt.

Where do I check Outlook forwarding rules in Microsoft 365?

Open Outlook on the web, go to Settings, then Mail, then Rules. Look for rules that forward, redirect, delete, or move mail you did not set up. Also check Forwarding under Mail settings for a mailbox-level forward to an outside address.

Why would an attacker create a silent forwarding rule?

So they can keep reading invoices, payment questions, and client replies after you change the password. The rule copies mail to their address or hides replies so you never see the warning signs.

Can I check this myself without an admin account?

Yes. Any user can open Outlook on the web and review their own Mail Rules and Forwarding settings. An administrator can also check mailbox forwarding and audit history across the whole office.

What if I find a rule I do not recognize?

Write down what it does and where it sends mail, then delete or disable it. Change your password, review MFA methods for anything unfamiliar, and tell IT. If money or client data may have been exposed, follow your incident plan or get help cleaning the mailbox.

Squared Away Tech serves offices of 5 to 100 people in the Tampa Bay and Sarasota area (Bradenton, Sarasota, Tampa, Ellenton, Lakewood Ranch, St. Petersburg, Palmetto, Venice and Parrish), serving small offices across Florida, and remotely anywhere in the U.S. Mon–Fri 5–9 PM and Sat 9 AM–5 PM (Eastern Time). Daytime and Sunday appointments available on request; daytime calls get a same-evening callback. Back to the home page · More guides

This guide is general information, not legal or insurance advice. Every office’s setup is different.