MFA fatigue attack
Also known as: MFA fatigue, push bombing, MFA bombing, MFA prompt bombing, push fatigue attack
An MFA fatigue attack, also called push bombing, happens when an attacker who already has someone's password repeatedly triggers multi-factor authentication push notifications, hoping the person will eventually tap 'approve' out of annoyance, confusion, or late-night tiredness.
Attackers sometimes pair it with a call or message pretending to be IT support. While MFA fatigue shows that simple push approvals can be tricked, number matching and phishing-resistant methods like passkeys largely stop it.
MFA fatigue attack, explained at three levels
At home
Imagine someone who already has your house key but still needs you to buzz them in. They ring the intercom over and over at 2 a.m. until you press the button just to make it stop. An MFA fatigue attack works the same way: a criminal with your password keeps triggering 'Is this you signing in?' alerts on your phone, hoping you eventually tap Yes.
At work
An MFA fatigue attack, also called push bombing, targets staff whose password has already been stolen. The attacker keeps signing in so the employee's phone fills with approval requests, sometimes adding a fake call from IT support, until someone taps Approve. One tap bypasses the company's multi-factor protection, which is why many businesses now require number matching or security keys instead.
At home
The attack only works because the criminal already has your password. They type it into the real sign-in page, which sends an approval request to your phone. You deny it, so they try again, and again, sometimes dozens of times, often late at night. The bet is that you will eventually tap Approve by mistake or just to make it stop. One tap, and they are in, with the protection of MFA bypassed.
At work
Microsoft Authenticator and Duo now use number matching, where the sign-in screen shows a number that must be typed into the phone, so a blind tap no longer works. Prompts also show the app name and approximate location to reveal mismatches. Administrators can limit push attempts, alert on repeated denials and require stronger methods for risky sign-ins. The 2022 Uber breach showed the pattern clearly: repeated pushes, plus a WhatsApp message posing as IT support.
At home
Attackers often pair the flood of prompts with a phone call or message pretending to be your IT team, saying you need to approve the request to fix a problem. This adds urgency and trust to the pressure. If you get a prompt you did not start, the right move is to deny it and change your password, since the request proves someone has it. In my view, no real IT team will ever ask you to approve a login you did not start.
At work
Push fatigue exploits any MFA method where the user approves without proof of context. Number matching and additional context reduce it, but only phishing-resistant authenticators, FIDO2 security keys, passkeys and certificate-based authentication remove it, because approval requires physical presence at the actual sign-in device. Treat several denied pushes on one account as a compromised-credential incident: reset the password, revoke sessions and investigate. Conditional access can block sign-ins from unfamiliar locations before a prompt is ever sent.
Real-world examples
At home
Aisha's phone showed five sign-in requests for her work account late one night. She denied them all and reported it, and IT found her password had been stolen in a phishing email.
At work
Jerome runs IT for a Vancouver architecture firm. After an attempted push-bombing attack, he turned on number matching for all staff and moved administrators to hardware security keys.
Common confusions
- If I have MFA, my account can't be hacked. — Push-based MFA can be beaten if you approve a request you didn't make. Phishing-resistant methods like passkeys or security keys close that gap.
- An unexpected MFA prompt is just a glitch. — It usually means someone has your password. Deny it and change your password.
For analysts
I'd add a simple rule to security training: never approve a sign-in you didn't start, and report it immediately. Then make number matching mandatory so the rule has backup.
History & origin
Push-notification MFA became popular in the 2010s because it was easier than typing codes. Attackers, including state-linked groups, began abusing it, and the tactic gained public attention in 2022. That year, the Lapsus$ group used it in several breaches, and in September 2022 an attacker breached Uber by repeatedly sending push requests to a contractor and then messaging them on WhatsApp pretending to be Uber IT. Microsoft responded by enforcing 'number matching' in its Authenticator app in May 2023, requiring users to type a number shown on the login screen, and other providers added similar protections. In my view, MFA fatigue proved that security that depends on people saying 'no' to repeated prompts will eventually fail.