MFA fatigue is an attack in which someone who already has a password floods the account owner's phone with login approval requests until one gets accepted, by accident or simply to make the prompts stop. CISA defines it as "also known as 'push bombing,'" where an attacker "bombards a user with mobile application push notifications until the user either approves the request by accident or out of annoyance with the nonstop notifications."

It matters because it defeats a control many companies consider finished. Push approvals are a real improvement over passwords alone, and the attack described in how phishing actually works and how to spot it usually ends with a stolen password. MFA fatigue is what happens next, when the attacker needs one more yes.

A brass apartment doorbell panel on a black wall with one button glowing hot pink, as if pressed over and over, a metaphor for MFA fatigue push-bombing — Push-bombing works like a doorbell that will not stop ringing. Eventually someone opens the door just to end the noise.

What is MFA fatigue, and how does push-bombing work?

Push-based MFA sends a prompt to an app on your phone whenever someone signs in with your password, and you tap approve or deny. The design assumes a prompt you did not expect will be denied. MFA fatigue turns that assumption around by sending prompt after prompt, and nothing stops them arriving late at night or in the middle of a busy workday.

The attacker needs only the password, which may come from an earlier phishing page, a reused password from another site's breach, or a purchase. From there the method is volume and timing. Sometimes it is paired with a message or call from someone claiming to be IT, which is a pretexting layer on top of the technical attack.

CISA's fact sheet on phishing-resistant MFA lists the same tactic among the threats push-based methods face: attackers "bombard a user with push notifications until they press the 'Accept' button."

How did MFA fatigue play out at Uber?

The best documented case is Uber in September 2022. In Uber's own security update, the company said it was "likely that the attacker purchased the contractor's Uber corporate password on the dark web." The attacker then tried to log in repeatedly.

Uber described what followed: "Each time, the contractor received a two-factor login approval request, which initially blocked access. Eventually, however, the contractor accepted one, and the attacker successfully logged in." Uber linked the attacker to the Lapsus$ group.

Two details are worth noticing. The MFA worked, several times, until a person under pressure approved one prompt. And the starting point was a password that had already left the building, which is why a password manager and unique passwords, covered in why your password manager is the best security investment, sit underneath everything else here.

An empty open-plan office at night with a single desk chair pushed back, lit by one hot pink light against black, the late-hour setting of an MFA fatigue attack — Prompts can arrive whenever attention is lowest. The attacker chooses the timing.

Why does push-bombing work on people?

I study behavioral psychology, and MFA fatigue is an unusually clean example of how a repeated stimulus wears down judgment. The first prompt gets a careful look. The tenth gets an irritated one. By the thirtieth, the goal has quietly shifted from judging a login to making the phone go quiet.

Habit adds to it. Most people approve prompts many times a week, nearly always for their own logins, so the approve tap becomes automatic. An attacker who sends prompts just as someone starts their morning routine is borrowing that habit. The same dynamic sits behind risk compensation: a control that feels protective can make people less watchful than they would otherwise be.

Blaming the person who tapped approve misses the design problem. A good control should not depend on someone staying alert at 2 a.m. after the twentieth notification, and the strongest option CISA recommends does not.

What should a $5M to $50M company switch on?

CISA's guidance gives a clear order of preference. Its number matching fact sheet describes number matching as "a setting that forces the user to enter numbers from the identity platform into their app to approve the authentication request," and says that "although number matching is not as strong as phishing-resistant MFA, it is one of the best interim mitigation[s]."

On the long-term answer, the phishing-resistant fact sheet is direct: "phishing-resistant MFA is the gold standard and organizations should make migrating to it a high priority effort." It adds that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," the standard behind hardware security keys and passkeys. NIST's definition of phishing resistance explains why it matters: it protects the login "without reliance on the vigilance of the claimant."

For a company in the $5M to $50M range, that translates into a practical sequence:

Confirm number matching is on everywhere. Since May 2023, Microsoft has enforced number matching for Microsoft Authenticator push notifications, and users cannot opt out (a few older setups, such as some NPS extension configurations, still fall back to approve or deny). Check the other systems that send push prompts: your VPN, payroll platform, finance tools and any separate identity provider.
Move the highest-risk accounts to security keys or passkeys first. Administrators, finance, payroll and anyone who can approve payments or reset other people's access. These are the accounts where one accepted prompt costs the most.
Lock down the help desk. Registering a new phone or resetting MFA should require a callback to a known number or an in-person check, so an attacker cannot simply enrol their own device.
Make denied prompts a signal. A burst of denied approvals on one account means someone has that password. Configure alerts if your identity platform supports them, and treat it as a password reset event.
Tell staff what to do with an unexpected prompt. Deny it, then report it. Reporting is the part people skip, and it is the only way the company learns a password is in the wrong hands.

None of this requires a security team, and it fits inside the baseline in five cybersecurity things every business should do first. The order matters more than the speed: number matching closes the easy gap this week, and keys for the riskiest accounts close the larger one over a quarter.

A brass combination padlock with its number dials lit hot pink against pure black, number matching as a defense against MFA fatigue — Number matching asks the person to prove they are looking at the login screen, not just their phone.

Is number matching enough to stop MFA fatigue?

It stops the blind approval, which is the core of push-bombing. Someone tapping approve to silence their phone cannot do so without the number shown on the attacker's screen. CISA still calls it an interim measure, because a number on a screen is still something a person can be persuaded to read out to a caller.

That is where phishing-resistant MFA earns the "gold standard" label. NIST's definition describes the difference: phishing-resistant authentication prevents the disclosure of secrets "to an impostor verifier," so a fake login page gets nothing usable, whatever the person has been told. Financial regulators point the same way: FinCEN's 2024 alert on deepfake fraud recommends MFA "including phishing-resistant MFA" among its best practices.

The technical controls also need a social one. If a prompt arrives with a message or call explaining it, that explanation is the attack. Your vishing and help-desk procedures should say plainly that IT will never ask anyone to approve a prompt or read out a code.

A small hardware security key on a metal key ring resting on black stone, rim-lit in hot pink, the phishing-resistant answer to MFA fatigue — FIDO/WebAuthn keys and passkeys are what CISA calls the gold standard, because they do not rely on anyone noticing the fake.

Not sure? Check before you act

If an approval prompt, text or call arrives that you did not start, deny it and do not reply, click or call any number it gives you. Read the real sender address or domain letter by letter. Contact IT yourself on a number you already have. For a suspicious message, screenshot it (crop out customer and personal data, never upload an attachment) and ask your company's approved AI assistant whether the company is real, the domain matches, and it fits a known scam; treat that as a second opinion. Report it the company way, even if you did nothing wrong. If money or a login was involved, reset the password, call your bank to request a recall if a payment went out, and file at ic3.gov. The full method is in how to check if a message is a scam.

At Kief Studio we build the verification into the systems themselves, so a login approval or an MFA reset cannot go through on one tired tap or one convincing phone call. We also run remote team sessions on exactly this: the prompts and requests your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering; briansgagne.com goes deeper on the technical side.

Frequently Asked Questions

What is MFA fatigue?

MFA fatigue, also called push-bombing, is when an attacker who has your password sends repeated login approval prompts to your phone until you accept one, by accident or out of annoyance. CISA uses that definition in its number matching guidance.

What should I do if I get MFA prompts I did not request?

Deny every one, do not approve any to make them stop, and report it to IT straight away. Unrequested prompts mean someone has your password, so it needs to be changed.

What is number matching in MFA?

Number matching shows a number on the login screen that you must type into your authenticator app to approve. CISA describes it as one of the best interim protections against push-bombing, though not as strong as phishing-resistant MFA.

What is phishing-resistant MFA?

MFA that cannot be fooled by a fake login page, such as FIDO/WebAuthn security keys and passkeys. CISA calls it the gold standard, and NIST defines phishing resistance as protection that works without relying on the user to spot the fake.

Did MFA fail in the Uber breach?

Uber said the contractor received repeated approval requests that initially blocked access, until the contractor accepted one. The control worked as designed; the attack succeeded by wearing down the person approving it.

Mfa

What Is MFA Fatigue? Push-Bombing and How to Stop It