An MFA fatigue attack is a social-engineering technique in which an attacker repeatedly sends multi-factor authentication requests to a person’s device, hoping the person will eventually approve one.
The attack is also known as:
- MFA bombing
- Push bombing
- Push fatigue
- MFA push spam
- Authentication prompt bombing
The victim may receive dozens of login notifications within a short period. They might approve one accidentally, dismiss it without reading, or accept it simply to stop the interruptions.
Once the request is approved, the attacker may gain access to the victim’s email, cloud account, company network, customer information, or administrative systems.
MFA fatigue demonstrates an important security principle: multi-factor authentication is significantly safer than password-only access, but not every MFA method provides the same protection.
How Does an MFA Fatigue Attack Work?
Most MFA fatigue attacks begin after a criminal has obtained the victim’s username and password.
The credentials might have been collected through:
- A phishing website
- Credential-stealing malware
- A previous data breach
- Password reuse
- Password spraying
- An infostealer infection
- Social engineering
- A compromised third-party service
The attacker enters the stolen credentials on the legitimate service. Because MFA is enabled, the service sends an approval request to the account owner’s registered device.
Instead of stopping after one rejected request, the attacker keeps trying.
A typical attack follows this pattern:
- The attacker obtains the victim’s password.
- They attempt to sign in to the real account.
- The service sends an MFA notification to the victim.
- The victim rejects or ignores the unexpected request.
- The attacker repeats the login attempt.
- The victim receives numerous approval prompts.
- The attacker may contact the victim while pretending to be technical support.
- The victim eventually approves a request.
- The attacker receives an authenticated session.
- The attacker begins accessing data or changing the account.
CISA describes this technique as push bombing or push fatigue, in which criminals bombard a user with notifications until the user approves one. CISA recommends phishing-resistant MFA as the strongest defense.
Why Would Someone Approve an Unexpected MFA Request?
Approving a suspicious request may appear irrational, but attackers deliberately create conditions that encourage mistakes.
Notification Fatigue
After receiving repeated alerts, a person may approve one simply to make the notifications stop.
This is especially effective when prompts arrive late at night, during meetings, or while the victim is performing another task.
Accidental Approval
Traditional push authentication may present only two choices: approve or deny.
A user handling a phone quickly can tap the wrong button, particularly when the prompt resembles a routine login notification.
Confusion With a Legitimate Login
The victim may already be signing in to another application and incorrectly assume the unexpected prompt is related to that activity.
Employees who authenticate frequently during the working day may find it difficult to associate every prompt with a specific login attempt.
Fake Technical-Support Calls
Attackers may call or message the victim while the notifications are arriving.
They might claim to represent:
- The company’s IT department
- A cloud provider
- The security team
- The help desk
- An identity-management service
- A software vendor
The criminal may say that approving the request is necessary to verify the account, install an update, stop an attack, or complete a security test.
Fear and Urgency
Messages such as “Your account will be disabled” or “We need immediate verification” can pressure the victim into acting before checking the request.
What Does an MFA Fatigue Attack Look Like?
A victim may notice:
- Several authentication prompts they did not initiate
- Requests arriving repeatedly within minutes
- Notifications appearing late at night
- Login attempts from an unfamiliar location
- Prompts for an application they do not recognize
- A phone call claiming the prompts are part of an IT process
- Requests to read out a verification code
- Someone asking them to approve a login to stop the notifications
- Password-reset messages they did not request
- New-device or new-location alerts
- A legitimate password suddenly being rejected
- Changes to registered authentication methods
One unsolicited MFA request should be treated seriously. A series of them strongly suggests that someone may already know the account’s password.
Is MFA Fatigue the Same as Phishing?
MFA fatigue is a form of social engineering, but it is not identical to conventional phishing.
Traditional phishing commonly tricks a victim into entering credentials on a fraudulent website. An MFA fatigue attack normally uses credentials that the attacker has already obtained and pressures the victim to approve the final authentication step.
The two methods can be combined.
An attacker may first use a phishing page to capture the password, then immediately generate authentication prompts. Because the victim has just attempted to sign in, the fraudulent request may appear legitimate.
What Is the Difference Between MFA Fatigue and Adversary-in-the-Middle Phishing?
An adversary-in-the-middle, or AiTM, attack places a malicious service between the victim and the legitimate login page. It may relay credentials and MFA information in real time and steal the authenticated session cookie.
MFA fatigue takes a different approach. It repeatedly triggers push notifications and relies on the victim to approve one.
Both attacks can defeat weaker authentication workflows. Phishing-resistant authentication methods, such as properly implemented FIDO security keys and passkeys, offer stronger protection because authentication is tied to the legitimate service.
What Is the Difference Between MFA Fatigue and SIM Swapping?
A SIM-swapping attack transfers the victim’s phone number to a device controlled by the attacker. The criminal may then receive authentication codes sent by SMS or phone call.
MFA fatigue does not require control of the phone number. The attacker sends legitimate approval requests to the victim’s real authentication device and attempts to persuade or exhaust them into approving access.
Both techniques show why SMS and simple push approvals are weaker than phishing-resistant authentication.
Why Are MFA Fatigue Attacks Dangerous?
A single approval may create a valid session that appears legitimate to the affected service.
Depending on the compromised account, the attacker may be able to:
- Read email
- Download cloud files
- Access customer records
- Steal confidential documents
- Impersonate the victim
- Send internal phishing messages
- Change security settings
- Register another authentication device
- Create application passwords
- Generate API tokens
- Access a VPN
- Enter administrative systems
- Change payment information
- Reset other account passwords
- Move laterally through the organization
- Establish persistent access
If an administrator approves the request, the attacker may gain access to many more accounts, applications, and security controls.
MITRE ATT&CK tracks this behavior as Multi-Factor Authentication Request Generation (T1621) and recommends monitoring excessive or anomalous MFA prompts, particularly when they originate from unfamiliar locations. MITRE ATT&CK’s T1621 guidance explains the technique and relevant detection opportunities.
Does an MFA Fatigue Attack Mean the Password Is Compromised?
In many cases, yes.
Authentication prompts are generally generated only after the attacker passes the password stage or reaches a workflow capable of triggering an MFA challenge.
Unexpected prompts may therefore indicate that:
- The password has been stolen
- The password was guessed
- The password is being reused from another breach
- An active session or authentication workflow is being abused
- A malicious application is attempting to connect
- Account-recovery information has been compromised
The user should not merely reject the requests and continue using the same password. The account should be investigated and secured.
Which MFA Methods Are Vulnerable to Push Bombing?
The greatest risk exists with systems that allow users to approve a login by tapping a simple Allow, Approve, or Yes button.
The prompt may contain insufficient information to connect it to a specific sign-in.
Risk increases when:
- Requests can be generated without meaningful limits
- The prompt does not display the application
- The location or device is not shown
- The user does not need to enter a matching number
- The organization permits unlimited authentication attempts
- Help-desk procedures allow weak identity verification
- Users are trained to approve prompts routinely
- Legacy authentication routes remain enabled
Code-based authenticators are not normally vulnerable to notification bombing in the same way because the user must deliberately retrieve and enter a code. However, codes can still be stolen through phishing or real-time relay attacks.
What Is Number Matching?
Number matching strengthens push-based authentication by showing a number on the login screen and requiring the user to enter that number in the authenticator application.
This connects the approval to a specific login attempt.
An attacker who knows the victim’s password but cannot see the legitimate login screen cannot easily tell the victim which number to enter.
Number matching helps prevent:
- Accidental approvals
- One-tap authorization
- Approval caused solely by notification fatigue
- Confusion between simultaneous login attempts
Microsoft identifies number matching as an important security improvement over traditional push notifications and enables it for Microsoft Authenticator push approvals. Microsoft’s number-matching guidance explains how it connects the prompt to the active sign-in.
Number matching is a meaningful improvement, but phishing-resistant MFA remains stronger.
What Is Phishing-Resistant MFA?
Phishing-resistant MFA uses cryptographic authentication that is connected to the legitimate website or application.
Common approaches include:
- FIDO2 security keys
- Passkeys
- WebAuthn authentication
- Platform authenticators
- Certificate-based authentication
- Smart cards, when correctly implemented
These methods verify the service’s identity instead of relying entirely on the user to decide whether a notification looks trustworthy.
A fake website generally cannot use a FIDO credential created for a different domain. There is also no generic approval prompt for an attacker to send repeatedly.
CISA recommends phishing-resistant MFA as the strongest widely available protection and suggests number matching when organizations cannot deploy phishing-resistant methods immediately. CISA’s MFA guidance provides a practical hierarchy of authentication options.
How Can Users Prevent MFA Fatigue Attacks?
Approve Only Requests You Initiated
Never approve an authentication request unless you have just attempted to sign in and can connect the request to that specific action.
If you are uncertain, reject it.
Read the Entire Prompt
Check:
- The application name
- The approximate location
- The device
- The time
- The requested action
- The displayed number
- Whether you initiated the login
Location information may be approximate, but a country or region unrelated to your activity is a strong warning sign.
Never Approve a Request Because Someone Calls You
A genuine support employee should not ask you to approve an unexpected login initiated by someone else.
If a caller claims to be from IT:
- End the call.
- Reject the authentication request.
- Contact the organization through its official support channel.
- Report the caller and the prompts.
Do not use a phone number or link supplied by the caller.
Change the Password Immediately
If unexplained requests appear, change the affected account’s password through the official website or application.
Use a unique password that is not shared with any other service.
Use a Password Manager
A password manager can generate and store unique passwords. This reduces the damage caused when credentials from one service are exposed.
Password managers also help users recognize phishing sites because saved credentials are normally associated with the correct domain.
Enable Phishing-Resistant Authentication
Use a passkey or hardware security key when the service supports one.
If those options are unavailable, choose number matching or a code-generating authenticator rather than simple one-tap approval or SMS.
Report Unexpected Prompts
Employees should report suspicious authentication activity immediately.
Fast reporting gives the security team an opportunity to:
- Lock the account
- Change the password
- Revoke sessions
- Block the attacker’s address
- Review login activity
- Protect other targeted users
How Can Organizations Prevent MFA Fatigue?
Replace One-Tap Push Approval
Organizations should move away from authentication systems that allow a login to be approved with a single tap.
Prefer:
- FIDO2 security keys or passkeys
- Certificate-based authentication
- Number-matching push authentication
- Authenticator-generated codes
- SMS or voice only when stronger methods are unavailable
Apply Rate Limits
Limit how many MFA requests can be generated for the same account within a short period.
Controls may include:
- Blocking repeated challenges
- Introducing increasing delays
- Temporarily locking suspicious authentication attempts
- Alerting after several rejected prompts
- Requiring help-desk review
- Blocking the originating IP address
Rate limits should prevent abuse without enabling attackers to create an easy denial-of-service condition.
Display Additional Context
Authentication prompts should show enough information for the user to make an informed decision, including:
- Application name
- Approximate location
- Device information
- Time of request
- Login risk
- Number matching
Microsoft notes that additional context can be combined with number matching to help users recognize suspicious sign-ins. Microsoft’s additional-context documentation describes the information that may be displayed.
Use Risk-Based Authentication
Identity systems can evaluate factors such as:
- Unfamiliar locations
- Impossible travel
- Anonymous proxies
- New devices
- Malware-associated IP addresses
- Unusual login times
- Repeated failures
- Abnormal user behavior
High-risk attempts can be blocked or required to use a stronger authentication method.
Protect the Help Desk
Attackers frequently combine MFA fatigue with phone-based impersonation.
Help-desk staff should not rely on easily discovered information such as:
- Employee ID numbers
- Birth dates
- Manager names
- Email addresses
- Phone numbers
- Security questions
Sensitive authentication resets should require strong, documented identity verification.
Restrict Authentication-Method Registration
After gaining access, attackers may attempt to register their own phone, authenticator, passkey, or security key.
Organizations should require strong reauthentication before allowing changes to:
- MFA devices
- Recovery addresses
- Phone numbers
- Passkeys
- Security keys
- Application passwords
- Trusted devices
Users should receive an immediate alert whenever a new authentication method is added.
Apply Conditional Access
Access policies can restrict authentication based on:
- Managed-device status
- Network location
- User risk
- Application sensitivity
- Authentication strength
- Device compliance
- Administrator role
Critical applications should require stronger authentication than low-risk services.
Train Users With a Simple Rule
Security training should emphasize:
If you did not initiate the login, reject the request and report it.
Employees should also understand that an unexpected prompt may mean their password has already been compromised.
Remove Legacy Authentication
Older protocols may bypass modern MFA and conditional-access protections.
Organizations should identify and disable unnecessary legacy authentication methods, application passwords, and outdated sign-in routes.
How Can Security Teams Detect MFA Fatigue Attacks?
Useful detection signals include:
- Numerous MFA prompts for one user
- Repeated rejected requests
- An approval after several denials
- Requests generated from unfamiliar countries
- Prompts occurring at unusual times
- Multiple users targeted from the same IP address
- A successful login immediately after notification spam
- New MFA registration after a suspicious login
- Login followed by mailbox-rule creation
- Session activity from two distant locations
- Help-desk calls coinciding with repeated prompts
- Authentication attempts using anonymizing services
- Changes to recovery information
Security teams should correlate identity logs with:
- VPN records
- Endpoint activity
- Cloud audit logs
- Email events
- Help-desk tickets
- Device-registration logs
- Network telemetry
- Application-access records
An approval should not automatically close the alert. Approval following many rejected prompts may be the strongest indication that the attack succeeded.
What Should You Do During an MFA Fatigue Attack?
If you are receiving unexpected authentication requests:
- Reject every request.
- Do not communicate with anyone who contacts you about approving them.
- Open the service through its official application or typed web address.
- Change the password.
- Sign out other active sessions.
- Review recent login activity.
- Check registered authentication methods.
- Remove unfamiliar devices.
- Report the incident to the service provider or security team.
- Preserve screenshots and relevant call or message details.
If it is a work account, contact the real IT or security team through the organization’s established channel.
What Should You Do If You Approved the Request?
Treat the account as compromised.
Disconnect the Attacker’s Access
The service provider or administrator should:
- Revoke active sessions
- Reset the password
- Revoke refresh tokens
- Disable suspicious application passwords
- Remove unauthorized authentication methods
- Revoke malicious OAuth grants
- Temporarily lock the account when necessary
Changing the password alone may not invalidate every existing session.
Review Account Changes
Investigate:
- New inbox rules
- Email forwarding
- Deleted security notifications
- Recovery-information changes
- Newly registered devices
- Added MFA methods
- OAuth application permissions
- API tokens
- Administrative actions
- File downloads
- Shared documents
- Payment changes
Investigate Connected Systems
A compromised email or identity account may provide access to other services through single sign-on.
Review every application connected to the identity, including:
- Cloud storage
- Collaboration platforms
- Customer databases
- Source-code repositories
- Financial tools
- Human-resources systems
- Administrative portals
- VPN services
Warn Other Users
Attackers may use the compromised identity to send convincing messages to colleagues, customers, or suppliers.
Notify possible recipients so they do not trust fraudulent requests sent from the affected account.
Does MFA Still Help?
Yes. MFA remains one of the most effective protections against account compromise.
The existence of bypass techniques does not make MFA useless. It means organizations should choose stronger authentication methods and configure them carefully.
Even basic MFA can block many password-only attacks. Number matching improves resistance to push bombing, while FIDO-based authentication provides stronger protection against both MFA fatigue and credential phishing.
The correct response is to improve MFA—not disable it.
Can Disabling Notifications Stop the Attack?
Silencing notifications may stop the immediate disruption, but it does not secure the account.
If an attacker is generating valid MFA prompts, the password or another part of the authentication process may already be compromised.
The user should reject the requests, change the password, revoke sessions, review the account, and report the incident.
Can Attackers Bypass Number Matching?
Number matching makes traditional push fatigue significantly more difficult, but it cannot prevent every form of social engineering.
An attacker may try to:
- Convince the victim to enter a displayed number
- Operate a real-time phishing proxy
- Impersonate technical support
- Steal an authenticated session
- Abuse account recovery
- Register a new authentication method
- Exploit a separate identity-system weakness
Users must still verify that they initiated the login. Phishing-resistant authentication offers stronger protection because it reduces dependence on the user interpreting a prompt.
Are MFA Fatigue Attacks Only Used Against Businesses?
No. These attacks can target any account that uses push-based authentication.
Potential targets include:
- Personal email accounts
- Social-media profiles
- Financial services
- Cryptocurrency platforms
- Cloud-storage accounts
- Gaming accounts
- Universities
- Healthcare systems
- Government services
- Corporate networks
Businesses attract particular attention because one employee account may provide access to valuable internal systems and information.
Why Is MFA Fatigue Successful?
MFA fatigue attacks exploit human attention rather than breaking encryption.
They succeed when authentication becomes a routine interruption instead of a deliberate security decision. Repeated prompts, poor notification design, time pressure, and convincing impersonation can turn a protective control into an approval mechanism for the attacker.
The most reliable defense combines:
- Phishing-resistant MFA
- Number matching
- Prompt rate limiting
- Risk-based access controls
- Strong help-desk verification
- Immediate incident reporting
- Careful monitoring of authentication activity
