MFA Fatigue
MFA fatigue floods the victim with push approvals until one is accepted by accident or to stop the noise, converting a strong factor into a social engineering channel.
Definition
MFA fatigue (push bombing) is an attack that repeatedly triggers MFA push notifications to the victim device. A tap intended to silence the phone — or a fraudulent helpdesk call telling the user to expect and approve prompts — grants the attacker the session. Number matching and rate limiting are the structural fixes.
Context and scope
Demonstrated in high-profile breaches. Relevant wherever push-based MFA is the primary factor for VPNs, email, and admin consoles.
Common misconceptions
- Push MFA is weaker than SMS — the factor is fine; the approval UX is the attack surface, and number matching closes it
- Alerting users on every prompt is the fix — alerts train users to dismiss notifications faster
- It requires the password — push fatigue also rides passwordless flows and OAuth grants; the prompt is the target
Anti-patterns
- Shipping always-approve push prompts without number matching or biometric gating
- Leaving notification retry behavior unbounded so attackers can script infinite prompts
- Publishing helpdesk procedures that instruct users to approve prompts during verification calls
Related concepts
Related examples
Authoritative source
https://www.cloudflare.com/learning/access-management/what-is-mfa-fatigue/
What it is
The second factor becomes a lever: generate enough prompts and one gets approved. Users approve to stop buzzing, or believe the helpdesk caller who explains the prompts are routine. The authentication model survives; the human decision point is what breaks.
How it works
The attacker with valid credentials repeatedly authenticates, triggering notifications. Defenses: number matching requiring the user to type a code shown on the login screen, approval rate limits and lockouts, contextual prompts showing request origin, and migrating admins to phishing-resistant factors like hardware security keys.
When to harden
Any push-based MFA surface, prioritizing privileged accounts. Pair technical controls with helpdesk policy: verification never involves approving an unexpected prompt.
Pitfalls
Number matching degrades against attackers who also control the screen the number is displayed on. Rate limits need account-level lockout that does not become a denial-of-service weapon against known users. Fatigue attacks move down the stack — OAuth consent prompts are the next surface to harden.