I got a request I did not make ("It wasn't me")

A request you did not make means someone typed your email on a sign-in page or, worse, knows your password. Never approve it.

What do I do?

1. Open the request on your phone.
2. Tap «It wasn't me».
3. Confirm with «Confirm: it wasn't me» (or «Back» if you tapped by mistake).

The result depends on the kind of request:

• Password sign-in or a browser confirmation: «Request declined and reported. The browser session that made it was ended.» If that session used your password, the password stops working until you recover it.
• Phone-only sign-in: «Request declined and reported. Nobody signed in to your account with it.»

"Decline" or "It wasn't me"?

When several requests arrive at once, the app warns that if you started only one, you should decline the others with «It wasn't me».

Why are my approvals paused?

Three requests declined with «It wasn't me», or three declined because of wrong codes, within 15 minutes pause phone approvals for that account for 15 minutes. The console shows «Phone approvals are paused for this account for a few minutes after repeated refusals. Try again later or use a passkey.» Your passkey keeps working.

What next?

1. If your password was locked, set a new one with «I forgot my access details» (when your organization allows it) or ask support for help. Meanwhile, sign in with your passkey or phone.
2. Tell your organization's administrator or support: someone may be trying to get into your account. This is a security incident.