What to do if…
your device suddenly asks for administrator permission for normal settings changes

What to do now

1. Leave the prompt unanswered.
   Do not approve it yet. Take a photo or screenshot if you can do that without clicking the prompt. Include the app name, publisher, file name, or wording shown on the prompt.

2. Write down what happened just before it appeared.
   Note whether you were changing a setting, installing an update, opening an attachment, plugging in a USB device, following a link, or seeing a browser pop-up. This helps you separate a normal system request from a suspicious one.

3. If the prompt was unexpected, disconnect briefly.
   Turn off Wi-Fi or unplug Ethernet while you check. This is a temporary safety pause, not a full fix.

4. Check what is asking for permission without approving it.

   • On Windows, open More details or Show details if available. Look for the program name and publisher. Treat an unknown, unverified, or unfamiliar publisher as a warning sign.
   • On Mac, only enter an administrator name and password if you recognise the app requesting it and you intentionally started a task that normally needs administrator approval, such as installing software or changing security settings.
   • On a phone or tablet, check whether the permission request belongs to an app you just opened. Be cautious if a browser page, advert, or unknown app is trying to push you into installing something.

5. If this is a work, school, or managed device, stop and contact IT.
   Use a known route such as your company portal, school helpdesk, intranet, saved IT number, or the device management contact you already trust. Send the screenshot and say: “I’m getting unexpected administrator permission prompts for normal settings changes.”

6. If this is your personal device, close the app that triggered it.
   If the prompt disappears and does not return, only continue if you are confident the request matched an action you started. If it returns repeatedly, appears when no relevant app is open, or follows a browser pop-up, treat it as suspicious.

7. Check recent changes on your personal device.
   Look at recently installed apps, browser extensions, and downloads. Remove only items you are confident are unwanted, especially fake cleaners, fake security tools, unknown extensions, or apps installed just before the prompts began.

8. Use trusted built-in update and scan tools.
   Reconnect only when you need to use trusted update tools. Update the operating system, browser, and security software from built-in settings or the official app store. Then run a full scan with your installed security software and follow its guidance.

9. If an email, text, website, or advert triggered the prompt, report the suspicious message, website, or advert.

   • For suspicious emails, forward the email to [email protected].
   • For suspicious texts, forward the text to 7726.
   • Do not reply to the sender, use links in the message, or call numbers shown in the message or pop-up.

10. If you already approved the prompt or entered the password, reduce further harm.
    Disconnect from the internet again. From a different trusted device, change passwords for important online accounts that used the same password, then turn on two-factor authentication where available. After the affected device has been checked or cleaned, change the device administrator password too.

11. If money, bank details, personal data, or remote access were involved, act on that first.
    Contact your bank or card provider using the number on your card, banking app, or official website if money was paid or bank details were shared. Keep screenshots, payment references, phone numbers, emails, web addresses, and notes about what happened.

12. Report cyber crime or fraud using the right UK route.

• In England, Wales or Northern Ireland, use Report Fraud for cyber crime or fraud.
• In Scotland, contact Police Scotland on 101 for non-emergencies.
• If there is immediate danger or a crime is happening now, call 999.