An unexpected MFA prompt at the front desk: what next?

A fictional interruption

You are checking in a patient when your phone asks you to approve a sign-in. You have not opened that account today. A second prompt arrives. It is tempting to tap Approve just to make the interruption stop. This is the moment to use your reporting process instead.

Deny, then use a known reporting route

Decline the unrequested approval. Contact IT through the number or help desk route the practice has already established. Do not use instructions from a stranger who calls or messages about the prompt. Tell IT which account was involved and when it happened. Never share a password or one-time code as part of an informal report.

If you already approved it

Report that fact promptly and accurately. Say what you approved and when; do not hide the mistake or assume that a second denial fixes the first approval. Follow the authorized team’s instructions for securing the account. Avoid making unrelated changes or deleting messages that the team may need to investigate.

Make the practice’s response easy to find

The office manager can prepare a short contact card listing the primary IT reporting channel, the backup route and who coordinates front-desk work during an account issue. Keep it available without requiring access to the affected account. Have IT review the card so the team uses the right process.

A question for the next huddle

Ask: “If a sign-in prompt appeared while you were with a patient, how would you report it without sharing account details at the desk?” Let teammates talk through the handoff. The goal is a calm, repeatable response. CISA’s MFA guidance is a useful reference for the manager and IT team when discussing account protections.

Further reading

• CISA: Require Multifactor Authentication

The dental-office examples are fictional SentryGuard teaching examples. Use your practice’s approved policies and reporting channels.