Number Matching Authentication is a security feature that asks you to type a short number shown on a login screen into your authenticator app before approving a sign-in request. It was added to push-based multifactor systems to stop approvals that a person grants without meaning to.
This article explains what the feature does, why push prompts alone can be abused, and how the matching step closes that gap. It also covers what the feature does not protect against, how to respond to unexpected prompts, and what to check when setting it up on personal or work accounts.
Why a Simple Yes Button Can Be Dangerous
Push notifications are a popular second factor because they are quick. When you sign in, the service sends a prompt to your phone, and you tap Approve to confirm that the attempt is yours. The convenience is real, but the design has a weakness: the approval screen tells you very little about the request beyond the account name.
If an attacker already knows your password, they can start a sign-in and trigger a prompt on your phone. A tired or distracted person may tap Approve just to make the notifications stop. Security researchers and vendors have described this pattern as push fatigue, and it is one reason the industry moved toward stronger approval steps.
Understanding this weakness is the starting point for Number Matching Authentication. The feature does not replace the password or the push prompt. It adds a check that makes a blind approval much harder to give.
How the Number Matching Step Works
When a sign-in begins on a computer or website, the login screen displays a two-digit number. At the same moment, the authenticator app on your phone sends a prompt that asks you to enter that number before you can approve the request. You must read the number on the sign-in screen and type it into the app.
If the number you type matches the one on the screen, the approval goes through. If it does not match, or if you are asked to type a number when you have not started a sign-in, you should deny the request.
The check is tied to the specific login attempt, so a number you saw on a different screen will not work.
The idea is simple. The person approving the request has to be looking at the sign-in screen, not just reacting to a buzz on the phone. This small extra action changes the approval from a reflex into a deliberate decision.
What Number Matching Protects Against
Number Matching Authentication is most useful against a few common patterns. Each of these depends on a victim approving a prompt they did not start, and the matching step interrupts that flow in several ways.
- Repeated prompts sent to a phone until the user taps Approve out of frustration
- A sign-in attempt that a user accepts by mistake while expecting a different notification
- An attacker who has a stolen password and waits for the victim to respond to a prompt
- Social engineering where someone claims to be IT support and asks you to approve a request
These protections matter because they target the human step in the process. The feature does not stop someone who has your password from trying, but it makes a successful approval require you to see and match the number. That gives you a clear point to notice that something is wrong and to deny the request instead.
What Number Matching Does Not Protect Against
No single feature covers every threat, and Number Matching Authentication has real limits. It depends on the user reading the number and comparing it carefully.
A person who types the number without looking at the sign-in screen gains little protection. It also does not help if the device itself is compromised, because malware on a phone or computer can potentially interfere with what is shown.
The feature also does not defend against real-time phishing sites that relay the matching number to a victim.
If an attacker tricks you into entering your password on a fake page and then displays a matching number to you, you may approve the request without realizing it. Phishing-resistant methods that bind the login to the real website address address this more directly.
Because of these limits, Number Matching Authentication should be treated as one layer among several. Strong unique passwords, device updates, and skepticism toward unexpected requests all remain important.
How to Respond to an Unexpected Prompt
If you receive a number matching request and you did not start a sign-in, do not enter the number. Deny the request in the app, and then check whether your account password may have been exposed. Changing the password and reviewing active sessions and trusted devices on the account is a sensible next step.
Some services also let you report suspicious sign-in attempts from within the app or the account settings. Reporting helps the service flag patterns and may block further attempts. If you are unsure, sign in directly through the official website or app rather than through any link in a message you did not expect.
Keep in mind that a legitimate sign-in can also trigger a prompt. Before you act, confirm that you are attempting to sign in somewhere right now. Taking a moment to think is the whole point of the feature, and it is better to deny a real request by mistake than to approve a forged one.
Setting Up Number Matching on Your Accounts
Number Matching Authentication is usually an option you turn on in an account’s security settings or in an organization’s identity policy. The exact steps differ by service, so consult the provider’s current help documentation. The following areas are where most people encounter the setting.
Checking Your Authenticator App
Start by confirming that your authenticator app is up to date and that the account is linked to the app you actually use. An outdated app may not display the matching step at all. Make sure the app is installed from the official app store for your phone and that notifications are enabled so prompts arrive promptly.
Keep your phone protected with a screen lock. Because the app holds the approval power, anyone who can open your phone could approve requests. Using a strong device passcode and enabling the phone’s own biometric open adds a useful barrier.
Enabling the Feature in Account Settings
Many providers place number matching under a section labeled for multifactor authentication or sign-in methods. Look for an option that requires you to enter a number when approving a push request. If you manage an account for an organization, your administrator may control this setting centrally, and you may not be able to change it yourself.
After enabling the setting, test it by signing in on a device you control and confirming that the number appears and that you can approve the request. Doing this once helps you recognize the normal flow, so an unexpected prompt stands out later.
Keeping Recovery Options Available
When you adjust sign-in methods, keep at least one recovery option available that you can reach if your phone is lost or replaced. Recovery codes stored securely, or a second verified method, prevent you from being locked out. Store recovery codes offline in a safe place rather than in a note on your phone.
Review your recovery setup periodically, especially after changing phones or phone numbers. A stale recovery method can be exploited, so remove old devices and numbers you no longer control. Consult your provider’s help pages for the specific recovery options it supports.
Common Questions About How the Feature Behaves
Readers often ask whether Number Matching Authentication slows sign-in too much. The added step takes only a few seconds, and most people find that the extra attention is worth it. The number changes with each sign-in attempt, so you cannot reuse one you saw earlier. This is intended behavior.
Another common question is whether the number works on any device. It is designed for the specific sign-in attempt on the screen in front of you.
If you are signing in on a new computer, you will see a fresh number there, and your phone will show a matching prompt. The number is not a general code you can carry between sessions.
Some people wonder whether the feature replaces the need for a password. It does not. Number Matching Authentication is an added check that works alongside your password. Keeping a strong, unique password remains essential, because the password is still the first step that an attacker must pass.
Evaluating Number Matching Against Other Methods
Number Matching Authentication sits between plain push prompts and stronger phishing-resistant methods. Plain push prompts are convenient but easy to approve reflexively.
Time-based one-time codes require typing a code from an app, which also creates a deliberate step, though a code can still be entered into a fake page. Hardware security keys and passkeys are generally considered stronger because they check the website address automatically.
When choosing among options, consider your own risk. A personal account with modest sensitivity may be well served by number matching, while an account that controls money, administrative access, or sensitive records may warrant stronger methods where available. Your provider’s documentation explains which methods it supports and how each handles phishing.
Remember that the best choice is the one you will use correctly. A strong method configured poorly offers less protection than a good method used carefully. Read the options, enable the ones your provider offers, and keep them current.
Warning Signs Worth Taking Seriously
Certain patterns should raise your attention when a number matching prompt appears. Noticing them early gives you the chance to deny the request and protect the account before damage occurs.
- You receive a prompt for a sign-in you did not start, especially at unusual hours
- Several prompts arrive in a short period, suggesting someone is repeatedly trying your password
- A phone call or message asks you to read out or approve a number, claiming to be support
- The number shown on the sign-in screen does not match what your app asks you to type
If you see any of these signs, deny the request and do not share the number with anyone. Then sign in through the official website or app directly to review account activity. Changing your password and checking connected devices and recovery details are sensible steps after a suspicious prompt. Reporting the attempt to the provider also helps.
Putting Number Matching to Practical Use
Using Number Matching Authentication well comes down to a few habits. Read the number on the sign-in screen before you type anything. Deny any request you did not start. Keep your authenticator app updated and your phone locked. Store recovery codes safely so you are not locked out if something goes wrong.
For households and small teams, consider talking through the feature with everyone who uses shared accounts. Explain that a prompt they did not expect is a reason to pause and deny, not to approve. A short conversation can prevent a common mistake that attackers depend on.
Looking ahead, many providers are moving toward phishing-resistant sign-in methods that remove the need for manual matching. Until those methods are available and suitable for your accounts, Number Matching Authentication offers a meaningful improvement over blind approval. Continue to review your settings periodically and follow your provider’s current guidance.