Due to a rise in cybercriminals targeting university systems—especially payroll and direct deposit information—the University of Iowa is implementing a more secure login method called Verified Duo Push.

Verified Duo Push strengthens Duo's multi-factor authentication (MFA) by adding an extra verification step.

During the push login process, users must enter a three-digit code from the device they are logging in with into the Duo Mobile app. This step ensures that only authorized users can complete the login, helping prevent unauthorized access—even if a criminal has your password.

Below, you'll find answers to common questions about Verified Duo Push and what to expect when the change goes into effect.

How do I log in using Verified Duo Push?

  1. When logging in to a UI service requiring Two-Step Login using a web browser, a Duo Verified Push prompt like the sample below will display on your computer or other device, showing a unique three-digit code.

    A screenshot of a web application showing a 3-digit code "803"

  2. Enter that code into the Duo Mobile app on your smartphone or tablet, as shown below, then choose the blue Verify button.

    Screen shot of website login page where "803" is entered into the keypad

NOTE: If the Duo Mobile app on your smartphone or tablet ever displays the above screen when you're not logging in, choose the red I'm not logging in button. That will alert IT staff to potential malicious activity.

How is Verified Duo Push more secure than Duo Push?

Requiring a three-digit code helps prevent “push fatigue” or “push harassment,” which are cyberattacks where hackers attempt to compromise resources by repeatedly sending verification pushes when you have not initiated the verification.

By sending pushes repeatedly, hackers hope you will become confused or frustrated by repeated pushes, which will trick you into approving illegitimate access. Adding the three-digit code helps to ensure that the push is a legitimate verification request you made. 

If there are multiple declined or incorrect login attempts, IT security will be notified of the security risk. Only approve pushes for requests that you have initiated, and do not provide the three-digit code to anyone.

Does Verified Duo Push work with smartwatches?

No. Unfortunately at this time, Verified Duo Push is not compatible with smartwatches. This may change over time as vendors update hardware and/or software for smartwatches.

When will this change take place?

Verified Duo Push will be introduced on April 17, 2025. However, not everyone will notice or see the change immediately as two-factor authentication is typically “saved” for 30 days for web-based apps.

Where will I see Duo Verified Push, and does it change how I use Duo Push in other applications?

Duo Verified Push only appears in browser-based login prompts. If you're using Duo with an integration that doesn’t involve a browser, you will continue to see the standard Duo Push experience. This is expected behavior, and no changes are required for non-browser-based logins.

Last updated
Article number
9116