UNEXPECTED REQUEST
Deny it and treat it as a warning.
If you receive an MFA request you did not initiate, do not approve it.
Deny it if that option is available. Report the activity through your organisation's normal security process. And remember what the unexpected prompt may be telling you: someone may already know your password.
The MFA request may be the warning, not the attack itself.