Multi-factor authentication adds an important security layer beyond passwords. Even when an attacker obtains a user’s password, MFA can prevent account access by requiring another form of verification. However, not every MFA method provides the same level of protection.
An MFA fatigue attack targets the human side of push-based authentication. Instead of technically defeating MFA, an attacker repeatedly sends authentication approval requests to a user’s phone, hoping the person eventually accepts one because of confusion, frustration, distraction, or social engineering.
This technique is also known as MFA bombing, push bombing, push fatigue, or MFA prompt bombing. It demonstrates why organizations should combine MFA with strong phishing prevention and identity-security controls rather than assuming every MFA deployment provides equal protection.
Understanding how these attacks work from a defensive perspective can help organizations identify vulnerable authentication workflows and move toward more phishing-resistant authentication.
What Is an MFA Fatigue Attack?
An MFA fatigue attack is a social-engineering technique in which an attacker generates repeated MFA approval requests for a targeted account.
The attacker typically already has, or believes they have, the victim’s primary credentials. They then attempt to authenticate repeatedly, causing push notifications to appear on the user’s registered device.
The attacker hopes the user will eventually approve a request.
This might happen because the victim:
- Becomes frustrated by repeated notifications
- Mistakes the request for a legitimate login
- Approves it accidentally
- Assumes accepting it will stop the notifications
- Is persuaded by someone impersonating IT support
The attack therefore targets user decision-making rather than directly breaking the cryptography behind MFA.
Why Do MFA Fatigue Attacks Work?
Push notifications are designed to make authentication convenient.
A legitimate user enters credentials, receives a notification, taps Approve, and continues working.
That convenience can create risk when the notification provides limited context.
If users become accustomed to approving MFA requests quickly, they may not carefully verify every prompt.
Attackers can exploit this behavior.
The situation becomes more dangerous when an attacker combines repeated notifications with social engineering. For example, the attacker may impersonate a help-desk employee and claim that the user needs to approve a request to resolve an account problem.
This combination of technical access attempts and psychological pressure makes MFA fatigue particularly concerning.
How Does an MFA Fatigue Attack Work?
Understanding an MFA fatigue attack does not require detailed offensive instructions. From a defensive perspective, the attack generally follows a recognizable sequence.
Credentials Are Compromised
The attacker first obtains valid account credentials through another security failure.
Potential sources can include:
- Phishing
- Credential reuse
- Malware
- Previous data breaches
- Social engineering
- Credential theft
The stolen password alone may not provide access because MFA is enabled.
Authentication Requests Reach the User
Attempts to authenticate can cause the legitimate account owner to receive MFA approval notifications.
One unexpected request may be rejected immediately.
Repeated requests, however, can create confusion or notification fatigue.
Social Engineering May Follow
Some attackers increase pressure by contacting the victim while the authentication prompts are appearing.
The attacker might impersonate:
- IT support
- A help-desk employee
- An administrator
- Another trusted person
The objective is to convince the victim that approving the request is necessary.
The User Approves a Request
If a fraudulent request is approved, the authentication system may treat the attacker as successfully verified.
What happens next depends on the account’s privileges, session controls, and other security measures.
MFA Fatigue Attack vs Traditional Phishing
Traditional phishing frequently attempts to steal credentials by directing users to fake login pages.
MFA fatigue is different.
The attacker may already possess the correct password and instead needs the victim to approve the second authentication factor.
The two techniques can also work together.
A phishing campaign could steal a password, after which MFA push bombing is used in an attempt to overcome the remaining authentication requirement.
This is why MFA should be viewed as one layer of defense rather than a complete solution to credential theft.
Warning Signs of an MFA Fatigue Attack
Users should recognize several potential warning signs.
An unexpected MFA notification deserves attention, particularly when the user is not attempting to sign in.
Other warning signs include:
- Multiple MFA prompts arriving close together
- Notifications at unusual times
- Prompts associated with unfamiliar locations
- Unexpected login alerts
- Calls claiming to be IT support immediately after prompts begin
- Requests to approve authentication that the user did not initiate
A user who receives an unexpected authentication request should deny it rather than approve it simply to dismiss the notification.
The event should also be reported according to the organization’s security procedures.
Why Push-Based MFA Can Be Vulnerable
The weakness is not MFA itself. The problem is how certain approval-based workflows operate.
A simple Approve/Deny prompt asks the user to make a security decision with limited context.
If the user sees many prompts every day, approving them can become habitual.
Attackers attempt to exploit that habit.
Organizations should therefore evaluate the strength of the authentication method rather than simply asking whether MFA is enabled.
Use Number Matching
Number matching can make push authentication more resistant to accidental approval.
Instead of receiving a simple Approve button, the authentication flow displays a number during the sign-in process. The user must enter or select the corresponding number on the authenticator.
An unsolicited notification becomes harder to approve accidentally because the victim did not initiate the login and therefore does not have the expected number.
Number matching can significantly improve traditional push authentication, although organizations requiring stronger phishing resistance should consider cryptographic authentication methods such as FIDO2 and passkeys.
Move Toward Phishing-Resistant MFA
One of the strongest ways to reduce MFA fatigue attack risk is to move away from authentication mechanisms that depend on users approving unexpected prompts.
Phishing-resistant methods include technologies based on FIDO standards.
Examples can include:
- Passkeys
- FIDO2 security keys
- Platform authenticators
- Windows Hello for Business
Passkeys use public-key cryptography and bind authentication to the legitimate service.
Organizations planning a broader transition can review how to implement passwordless authentication to understand how passkeys, FIDO2, enrollment, and recovery can fit into an authentication strategy.
Use Passkeys Where Supported
Passkeys provide an important alternative to traditional passwords and push-based authentication.
Rather than asking a user to approve a remote login notification, passkeys use cryptographic credentials associated with the legitimate service.
Users may authorize access using:
- Fingerprint
- Face recognition
- Device PIN
- Security key
This makes the authentication experience both convenient and more resistant to common phishing techniques.
Windows environments can also use a Windows security passkey where supported as part of a broader move toward passwordless authentication.
Apply MFA Request Rate Limits
Organizations should prevent unlimited authentication prompts where their identity platform provides appropriate controls.
Repeated MFA requests within a short period can be a useful risk signal.
Security teams can establish controls that:
- Restrict excessive requests
- Temporarily block suspicious authentication attempts
- Generate alerts for abnormal MFA activity
- Trigger additional identity verification
- Require security investigation
The precise threshold should reflect normal business activity and the capabilities of the identity platform.
Overly aggressive controls can accidentally lock out legitimate users, so testing is important.
Monitor Repeated MFA Denials
Repeated denied authentication requests can indicate that someone else possesses the account password.
This is an important point.
If a user receives ten fraudulent MFA requests and rejects all ten, MFA successfully prevented access—but the incident should not necessarily be considered resolved.
The repeated attempts may indicate that the primary credential is compromised.
Security teams should investigate the account, review authentication activity, and determine whether credential reset or session revocation is necessary.
Strengthen Identity and Access Management
Authentication should operate within a broader identity-security strategy.
Organizations should apply principles such as:
- Least privilege
- Conditional access
- Risk-based authentication
- Strong device controls
- Privileged-access management
- Session monitoring
- Regular access reviews
Effective identity and access management can reduce the damage possible even if an attacker successfully compromises one account.
Privileged accounts deserve particularly strong controls because their compromise may provide access to sensitive infrastructure.
Use Conditional Access
Conditional access allows organizations to evaluate additional information before granting access.
Signals might include:
- User identity
- Device compliance
- Location
- Authentication strength
- Application sensitivity
- Sign-in risk
- User risk
For example, an organization might require stronger authentication when a privileged account signs in from an unfamiliar device or location.
This approach provides more context than treating every successful MFA approval as equally trustworthy.
Train Users to Reject Unexpected Prompts
Technical controls are important, but employees also need simple instructions.
Users should understand one fundamental rule:
If you did not initiate the login, do not approve the authentication request.
Training should also explain that legitimate IT personnel should not pressure employees to approve unexplained authentication requests.
Users should know how to report suspicious prompts quickly.
Training works best when instructions are clear and practical rather than overly technical.
Create an Easy Reporting Process
Employees are more likely to report suspicious authentication activity when the process is simple.
Organizations might provide:
- A dedicated security-reporting channel
- An internal help-desk option
- A security email address
- Built-in authenticator reporting where supported
Security teams should encourage prompt reporting because an unexpected MFA request may indicate that an account password has already been compromised.
Protect Help-Desk Processes
Attackers may combine MFA fatigue with help-desk social engineering.
Organizations should therefore secure account recovery and authentication-reset procedures.
Help-desk staff should verify identity before:
- Resetting MFA
- Registering a new authenticator
- Changing account-recovery details
- Issuing temporary access credentials
- Resetting privileged accounts
A strong authentication system can still be undermined by a weak recovery process.
Protect Privileged Accounts
Administrators, security personnel, executives, developers, and other high-value users may face greater consequences if their accounts are compromised.
For these accounts, organizations should consider stronger requirements such as:
- Phishing-resistant MFA
- Hardware security keys
- Passkeys
- Managed devices
- Privileged-access workstations
- Restricted administrative sessions
A simple push notification may not provide sufficient assurance for highly sensitive operations.
What to Do During an MFA Fatigue Attack
If a user begins receiving unexplained authentication requests, the organization should respond quickly.
A defensive response may include:
- Reject all unexpected MFA requests.
- Report the activity to the security team.
- Review recent authentication logs.
- Reset compromised credentials when appropriate.
- Revoke suspicious active sessions.
- Review registered authentication methods.
- Investigate unfamiliar devices or locations.
- Determine how the original credentials were exposed.
- Monitor the account for continued suspicious activity.
If the user accidentally approved a request, treat the event as a potential account compromise rather than simply changing the password and assuming the problem is resolved.
MFA Fatigue Attack Prevention Best Practices
Organizations can reduce risk by combining several controls:
- Enable number matching for push authentication.
- Prefer phishing-resistant MFA.
- Deploy passkeys or FIDO2 where appropriate.
- Monitor repeated authentication requests.
- Alert on repeated MFA denials.
- Apply rate limiting where supported.
- Use conditional access.
- Protect privileged accounts with stronger authentication.
- Train users to reject unexpected prompts.
- Create simple incident-reporting procedures.
- Protect MFA enrollment and recovery.
- Review authentication logs.
- Revoke suspicious sessions.
- Reduce dependence on passwords where practical.
No single control provides complete protection. Layered identity security is more effective.
Common MFA Security Mistakes
Several mistakes can make an MFA fatigue attack more likely to succeed.
Assuming All MFA Is Equally Secure
SMS codes, push notifications, TOTP codes, security keys, and passkeys have different security characteristics.
Ignoring Rejected Prompts
Repeated rejected prompts can indicate that an attacker already has the correct password.
Poor User Training
Employees who do not understand unexpected authentication prompts may approve them accidentally.
Weak Account Recovery
Attackers may bypass strong authentication by targeting support staff or recovery workflows.
Excessive Privileges
A compromised user account becomes more dangerous when it has unnecessary access.
MFA Fatigue Attack Prevention Checklist
Security teams can use this checklist:
- Is number matching enabled?
- Are simple push approvals still necessary?
- Are repeated MFA requests monitored?
- Are denied requests investigated?
- Are privileged accounts using phishing-resistant MFA?
- Are passkeys or FIDO2 supported?
- Can suspicious sessions be revoked quickly?
- Are users trained to reject unexpected prompts?
- Are MFA reset procedures securely verified?
- Are authentication logs retained?
- Is conditional access configured?
- Are users encouraged to report suspicious prompts immediately?
Organizations should periodically test these processes rather than waiting for an actual incident.
Future of MFA Security
Authentication is gradually moving away from passwords combined with approval-based second factors toward cryptographic credentials.
Passkeys and FIDO2 authentication can reduce dependence on both passwords and vulnerable push-approval workflows.
Risk-based authentication is also becoming more sophisticated. Identity systems can increasingly evaluate devices, locations, behavior, authentication strength, and other contextual signals before granting access.
These developments will not eliminate identity attacks. Attackers may increasingly target account recovery, device compromise, session tokens, or social-engineering workflows instead.
Authentication strategies therefore need to evolve continuously.
Conclusion
An MFA fatigue attack demonstrates an important cybersecurity lesson: enabling multi-factor authentication is not enough by itself. Organizations also need to consider which MFA method they use and how attackers could manipulate its user experience.
Repeated push notifications can pressure or confuse users into approving a login they never initiated. Number matching, rate limiting, conditional access, monitoring, employee education, and secure recovery procedures can all reduce this risk.
For stronger protection, organizations should increasingly consider phishing-resistant authentication methods such as FIDO2 security keys and passkeys. Combining these technologies with broader passwordless authentication strategies can reduce dependence on both reusable passwords and simple push approvals.
Ultimately, preventing an MFA fatigue attack requires layered identity security. Strong authentication technology, carefully designed access policies, effective monitoring, and users who understand how to respond to unexpected prompts provide substantially stronger protection than relying on an Approve button alone.
FAQs
What is an MFA fatigue attack?
An MFA fatigue attack involves repeatedly triggering authentication approval requests in an attempt to persuade or confuse a user into approving an unauthorized login.
What is MFA bombing?
MFA bombing, push bombing, and MFA fatigue generally describe attacks involving repeated MFA push notifications sent to a targeted user.
Why would someone receive repeated MFA requests?
If you are not attempting to sign in, repeated requests could indicate that someone is attempting to access your account and may already possess your password or other primary credential.
What should I do if I receive an unexpected MFA request?
Reject the request and report it through your organization’s security process. Repeated unexpected requests should be investigated because they may indicate compromised credentials.
Does number matching prevent MFA fatigue attacks?
Number matching makes accidental approval considerably harder because the user must match information displayed during the legitimate sign-in process. It should still be combined with other security controls.
Are passkeys resistant to MFA fatigue?
Passkeys do not rely on the same unsolicited Approve/Deny push workflow, so they can remove the specific push-fatigue mechanism while also providing phishing-resistant authentication.
Can MFA still be hacked?
MFA substantially improves account security, but different MFA methods have different weaknesses. Attackers may target users, devices, recovery procedures, sessions, or weaker authentication methods instead of directly breaking MFA.
What is the best way to prevent an MFA fatigue attack?
Use phishing-resistant authentication where possible, enable number matching for remaining push-based MFA, monitor excessive authentication requests, protect account recovery, apply conditional access, and train users never to approve a login they did not initiate.
Leave a comment