Why or when does macOS prompt you for your iPhone passcode?

[Doctor Q]

I've never seen this prompt, but a friend of mine has gotten it twice on his Mac and wonders if it's legit and why it's being asked. His Mac is on macOS 10.15 (Catalina). His iPhone is on iOS 14.2. They aren't physically connected. He hasn't recently installed a macOS update or any other updates, or logged in or out of iCloud.

Why did this prompt appear?

 

[Erehy Dobon]

This is called two-factor authentication (2FA). It provides an extra layer of security. For macOS/iOS it is not required unless you try to do certain things like set up Apple Pay. Note that once you turn on 2FA you cannot turn it off for that Apple ID.

Here are two Apple support documents that cover this topic:

Two-factor authentication for Apple Account - Apple Support

Two-factor authentication is designed to make sure that you're the only person who can access your account. Learn how it works and how to turn on two-factor authentication.

support.apple.com

Apple Platform Security

Learn how security is implemented in Apple hardware, software, apps, and services.

support.apple.com

2FA is not new for Apple; it has been around for several years.

Note that includes certain Apple websites. I have 2FA configured on one of my Apple IDs. If I log into www.icloud.com on a Windows PC web browser that doesn't have the proper icloud.com cookie, I will also be prompted with a similar window in the browser.

The prompt often shows up when you attempt to transition from low security to high security. This could be something like adding a feature like Apple Pay. This also happens when you attempt to register a new program/system/web browser, when the authenticity of the access request has not yet been established.

Since you have never seen this prompt, I'm willing to bet that you have never configured any of your Apple devices for Apple Pay.

 

[brianmowrey]

2FA would normally send an Allow prompt to a logged-in iOS device, and require the Mac user to enter the code that displays on the iOS device after logging in.

Your friend must be logging in to an Apple ID that hasn't been logged into an iOS device after the "trusted device" paradigm was put in place, or in a smaller realm of likelihood, active on any device in a certain time period. This then defaults 2FA to redirect to what presumably is an encrypted snapshot of the passcode of the device formerly logged into the Apple ID before the "trusted device" regime.

Just tell your friend to enter the likely correct 6-digit code and 2FA will snap to the Mac. iOS passcodes, your friend should keep in mind, are hardly silver bullets. If the whole world found out mine was 2222, uh, so what? You still have to achieve physical possession of my device. It's like hiding your debit card pin. Yawn.

 

[Doctor Q]

Thanks, Erehy Dobon and brianmowrey. Your explanations answered his questions.

He replied to the prompt and he's no longer concerned that something is amiss.