MFA fatigue attacks: when approval prompts become the weak spot

Understanding the MFA fatigue attack

Multi-factor authentication (MFA) is one of the most effective security controls available, but it is not invincible. As businesses have adopted MFA, attackers have developed new ways to bypass it. The MFA fatigue attack, also known as 'push bombing,' is a clever tactic that targets the human user rather than the technology itself. It relies on the simple fact that people can be worn down by constant interruptions.

In this scenario, an attacker already has the user's username and password—likely from a previous data breach or a phishing site. However, they are blocked by the MFA prompt. To get past it, they trigger dozens or even hundreds of push notifications to the victim's phone in a very short period. The hope is that the victim, tired of the constant buzzing, will eventually hit 'Approve' just to make it stop.

How the attack unfolds: a step-by-step look

An MFA fatigue attack is often paired with other social engineering tactics to increase the chance of success. It is rarely just a series of random notifications.

1. Credential Theft: The attacker obtains the user's primary login credentials through phishing or a credential stuffing attack.
2. Initial Bombing: The attacker begins triggering MFA push notifications, often late at night or early in the morning when the victim is tired.
3. The Social Engineering Call: If the victim doesn't approve the prompt immediately, the attacker may call them, pretending to be from IT, and tell them they need to 'approve the final notification' to fix a system error.
4. The Approval: The victim, overwhelmed or confused, approves the request, granting the attacker full access to the account.

Why 'push to approve' is no longer enough

For years, the 'push to approve' method was considered the gold standard for MFA because it was easy for users. However, its simplicity is now its biggest weakness. Because it requires only a single tap with no context, it is too easy for a user to approve a request by accident or out of habit. This has led many security experts to recommend moving away from simple push notifications in favor of more secure methods.

Better alternatives: number matching and FIDO2

The most effective way to prevent MFA fatigue is to change the way the authentication prompt works. Modern MFA systems offer 'number matching' as a default feature. With number matching, the user's login screen displays a two-digit code. The user must then type that specific code into their MFA app to approve the login. This ensures the user is physically present at the login screen and cannot 'accidentally' approve a remote request.

An even more secure option is the use of hardware security keys, such as those following the FIDO2 standard. These physical devices must be plugged into the computer or tapped against the phone to authorize a login. Because they require physical proximity, they are virtually immune to remote MFA fatigue attacks.

Policy and training for MFA safety

Technical controls should be supported by clear policies. Employees need to know what to do if they receive an MFA prompt they didn't trigger. The standard response should be to 'Deny' the request and immediately change their password, as a prompt means their password has likely been compromised.

• Instruct employees to never approve an MFA prompt unless they are actively trying to log in.
• Require immediate reporting of 'unsolicited' MFA prompts to the IT or security department.
• Enable number matching across all company applications that support it, including Microsoft 365 and Google Workspace.
• Consider deploying hardware security keys for high-risk accounts, such as IT administrators and financial officers.