If you receive a 2-Step Verification prompt on your phone when you are not actively logging in to a BC Service or your BC Google Account, an attacker may be trying to access your account. Cybercriminals often try to bypass multi-factor authentication by spamming unauthorized login requests, hoping you will tap "Approve" out of habit or distraction.
What to Do If You Receive an Unexpected 2-Step Prompt
If your phone receives a Duo or Google 2-Step login prompt (push notification, phone call, or text message) when you are not actively trying to sign in:
- DO NOT approve or allow the request. Select “No, don’t allow”, “Deny”, ignore the text code, or hang up the phone call.
- Change your BC Passwords: An unexpected prompt means an attacker already possesses your current passwords. Update your BC Password (used for Agora Portal) and your BC Google Password right away.
Recommendations from the BC IT Security Team
- Be eagle-eyed about notifications from Duo and Gmail: Always verify the context of a sign-in attempt before approving any notification. Pay attention to alerts from Google. If you did not log into a new device, but Google says you did, select "No, don’t allow".
- Keep your passwords unique: Your BC Password and your BC Google Password should be unique from each other, and unique from any other personal internet logins you use. Reusing passwords across multiple sites significantly increases your risk.
- Learn more:
- Learn about BC 2-Step Verification at bc.edu/2step.
- Learn about Google 2-Step Verification at bc.edu/google2step
What to Do If You've Been Targeted
If you think you fell victim to a scam, please contact the IT Security team at security@bc.edu and they will provide you with next steps for protecting your account.