One login prompt was mine. The next six arrived while I was asleep

The first sign-in approval was mine. I had opened the payroll site on my laptop, saw the prompt on my phone, and approved it.

The next six arrived between 1:12 and 1:19 in the morning.

I noticed them when I woke up. Each prompt looked routine enough that I understood how someone could tap approve just to make the buzzing stop. None of them included a useful explanation beyond a general location and a request to confirm the sign-in.

I rejected the prompts and used a known route to the account rather than following anything inside the notifications. I changed the password, reviewed the account's recent activity and recovery details, and checked whether any unfamiliar session was still active. I also contacted the service through its official support path because I did not want to guess whether the prompts reflected a mistyped username, reused credentials, or something else.

What bothered me was how quickly security became a reflex test. The same approval gesture that protected the legitimate login could have approved an unwanted one if I had been tired, distracted, or annoyed.

I want a household rule simple enough to remember: never approve a prompt you did not just initiate, and do not approve one merely to silence it. If repeated prompts appear, open the account independently, secure it, and preserve enough detail to explain what happened.

Is that rule sufficient for ordinary users? What would you check first after a burst of unrequested approval prompts, and which details are worth recording before the notifications disappear?