The verification code option for Duo Push provides added security by asking you to enter a code from the Duo Prompt into the Duo Mobile app. This helps prevent push fatigue attacks and encourages you to report suspicious login attempts.
Instructions
For more information, see Duo Documentation: Verified Duo Push (External Link).
INFO: Each login attempt uses a unique 3 digit code. Make sure to enter the code shown on your screen for that specific request.
WARNING: Do not approve any Duo Push request you did not start. Always tap I am not logging in if you suspect the request is fraudulent and then contact IT.
Verified Duo Push
- Start signing in to a University of Maine System service.
- The Duo Prompt on your computer will show a 3 digit code.
- Open Duo Mobile on your phone.
- Tap the login request.
- Enter the 3 digit code shown on the computer into Duo Mobile.
- Tap Verify to approve the login.
Verified Duo Push in the Duo Windows (RDP) Prompt
University Remote Desktop Protocol (RDP) services show a Duo Windows Prompt during sign in. When Verified Duo Push is required, the Windows Prompt also displays a 3 digit code. The code may appear in a different place than the standard Duo Prompt, so it can be easy to miss. Enter this code in Duo Mobile to complete your sign in.
- Sign in to your Windows computer as usual.
- When the Duo Windows Prompt appears, it will show a 3 digit code.
- Open Duo Mobile on your phone.
- Tap the request shown for your Windows sign in.
- Enter the code from the Windows Prompt into Duo Mobile.
- Tap Verify to complete sign in.
How to report a suspicious Duo Push request
If you receive a Duo Push request you did not start, you should report it right away. Duo Mobile includes an option that tells Duo that the request is suspicious. This helps protect your account and alerts security teams.
- Open Duo Mobile when you see a login request you did not start.
- Tap the option labeled I am not logging in.
- Duo will record the report and the request will be denied.
- Immediately change your password and contact IT for assistance.
Known issues
Some Duo Verified Push behaviors may look unusual but do not affect your ability to sign in.
- Phone notification stays on screen after you already signed in. You may still see the Duo Mobile notification on your phone even after you entered the code and successfully logged in.
- "Expired Request" message when tapping the notification after sign in. If you open the notification after you have already completed the login, Duo may show an Expired Request message. This happens because the request is only valid during the sign in process. You can safely dismiss the message.
Environment
- MFA (Multi Factor Authentication)
- Duo
- Duo Mobile for iOS and Android
- Duo Windows Prompt
- University of Maine System login services