New account security idea: *Active* MFA. Where you can’t even receive an MFA request unless you have your authenticator open and toggled to allow requests. Think of it like a credit freeze, same concept.

Possibly related: I am so unbelievably tired of people trying to hit my Microsoft accounts.