MFA fatigue is push-bombing: login prompts sent again and again until one is approved. That is how an attacker got into Uber in September 2022, per Uber's own update. CISA calls phishing-resistant MFA the gold standard; here is what to switch on first.
MFA fatigue is an attack in which someone who already has a password floods the account owner's phone with login approval requests until one gets accepted, by accident or simply to make the prompts stop. CISA defines it as "also known as 'push bombing,'" where an attacker "bombards a user with mobile application push notifications until the user either approves the request by accident or out of annoyance with the nonstop notifications."
It matters because it defeats a control many companies consider finished. Push approvals are a real improvement over passwords alone, and the attack described in how phishing actually works and how to spot it usually ends with a stolen password. MFA fatigue is what happens next, when the attacker needs one more yes.
Push-based MFA sends a prompt to an app on your phone whenever someone signs in with your password, and you tap approve or deny. The design assumes a prompt you did not expect will be denied. MFA fatigue turns that assumption around by sending prompt after prompt, and nothing stops them arriving late at night or in the middle of a busy workday.
The attacker needs only the password, which may come from an earlier phishing page, a reused password from another site's breach, or a purchase. From there the method is volume and timing. Sometimes it is paired with a message or call from someone claiming to be IT, which is a pretexting layer on top of the technical attack.
CISA's fact sheet on phishing-resistant MFA lists the same tactic among the threats push-based methods face: attackers "bombard a user with push notifications until they press the 'Accept' button."
The best documented case is Uber in September 2022. In Uber's own security update, the company said it was "likely that the attacker purchased the contractor's Uber corporate password on the dark web." The attacker then tried to log in repeatedly.
Uber described what followed: "Each time, the contractor received a two-factor login approval request, which initially blocked access. Eventually, however, the contractor accepted one, and the attacker successfully logged in." Uber linked the attacker to the Lapsus$ group.
Two details are worth noticing. The MFA worked, several times, until a person under pressure approved one prompt. And the starting point was a password that had already left the building, which is why a password manager and unique passwords, covered in why your password manager is the best security investment, sit underneath everything else here.
I study behavioral psychology, and MFA fatigue is an unusually clean example of how a repeated stimulus wears down judgment. The first prompt gets a careful look. The tenth gets an irritated one. By the thirtieth, the goal has quietly shifted from judging a login to making the phone go quiet.
Habit adds to it. Most people approve prompts many times a week, nearly always for their own logins, so the approve tap becomes automatic. An attacker who sends prompts just as someone starts their morning routine is borrowing that habit. The same dynamic sits behind risk compensation: a control that feels protective can make people less watchful than they would otherwise be.
Blaming the person who tapped approve misses the design problem. A good control should not depend on someone staying alert at 2 a.m. after the twentieth notification, and the strongest option CISA recommends does not.
CISA's guidance gives a clear order of preference. Its number matching fact sheet describes number matching as "a setting that forces the user to enter numbers from the identity platform into their app to approve the authentication request," and says that "although number matching is not as strong as phishing-resistant MFA, it is one of the best interim mitigation[s]."
On the long-term answer, the phishing-resistant fact sheet is direct: "phishing-resistant MFA is the gold standard and organizations should make migrating to it a high priority effort." It adds that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," the standard behind hardware security keys and passkeys. NIST's definition of phishing resistance explains why it matters: it protects the login "without reliance on the vigilance of the claimant."
For a company in the $5M to $50M range, that translates into a practical sequence:
None of this requires a security team, and it fits inside the baseline in five cybersecurity things every business should do first. The order matters more than the speed: number matching closes the easy gap this week, and keys for the riskiest accounts close the larger one over a quarter.
It stops the blind approval, which is the core of push-bombing. Someone tapping approve to silence their phone cannot do so without the number shown on the attacker's screen. CISA still calls it an interim measure, because a number on a screen is still something a person can be persuaded to read out to a caller.
That is where phishing-resistant MFA earns the "gold standard" label. NIST's definition describes the difference: phishing-resistant authentication prevents the disclosure of secrets "to an impostor verifier," so a fake login page gets nothing usable, whatever the person has been told. Financial regulators point the same way: FinCEN's 2024 alert on deepfake fraud recommends MFA "including phishing-resistant MFA" among its best practices.
The technical controls also need a social one. If a prompt arrives with a message or call explaining it, that explanation is the attack. Your vishing and help-desk procedures should say plainly that IT will never ask anyone to approve a prompt or read out a code.
If an approval prompt, text or call arrives that you did not start, deny it and do not reply, click or call any number it gives you. Read the real sender address or domain letter by letter. Contact IT yourself on a number you already have. For a suspicious message, screenshot it (crop out customer and personal data, never upload an attachment) and ask your company's approved AI assistant whether the company is real, the domain matches, and it fits a known scam; treat that as a second opinion. Report it the company way, even if you did nothing wrong. If money or a login was involved, reset the password, call your bank to request a recall if a payment went out, and file at ic3.gov. The full method is in how to check if a message is a scam.
At Kief Studio we build the verification into the systems themselves, so a login approval or an MFA reset cannot go through on one tired tap or one convincing phone call. We also run remote team sessions on exactly this: the prompts and requests your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering; briansgagne.com goes deeper on the technical side.
MFA fatigue, also called push-bombing, is when an attacker who has your password sends repeated login approval prompts to your phone until you accept one, by accident or out of annoyance. CISA uses that definition in its number matching guidance.
Deny every one, do not approve any to make them stop, and report it to IT straight away. Unrequested prompts mean someone has your password, so it needs to be changed.
Number matching shows a number on the login screen that you must type into your authenticator app to approve. CISA describes it as one of the best interim protections against push-bombing, though not as strong as phishing-resistant MFA.
MFA that cannot be fooled by a fake login page, such as FIDO/WebAuthn security keys and passkeys. CISA calls it the gold standard, and NIST defines phishing resistance as protection that works without relying on the user to spot the fake.
Uber said the contractor received repeated approval requests that initially blocked access, until the contractor accepted one. The control worked as designed; the attack succeeded by wearing down the person approving it.
What is quishing? Phishing hidden in a QR code, so nobody can read the link before scanning. The FBI warned in January 2026 that quishing pushes victims from work computers to phones, past email security controls.
What is pretexting? An invented story that makes a request for money, data or access feel routine. Verizon's 2026 DBIR found a human element in 62% of breaches. Why conscientious people get caught, and how callbacks stop it.
Business email compromise drew 24,768 FBI complaints and about $3.05 billion in reported losses in 2025. How vendor payment-change fraud works, the callback rule that stops it, and the first hour after a fraudulent wire.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
