User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.