Multi-factor authentication blocks over 99% of account takeover attacks. Never approve an MFA push notification unless you just tried to log in. A random prompt means someone is trying to get in — deny it and report it.