MFA fatigue, also called push bombing, works by flooding a user with MFA approval prompts until they tap approve to make the noise stop, usually at 2 a.m. when judgment is worst. The attacker already has the password, stolen or phished, and needs only that one tap. The fix is to stop using push approvals as the factor: switch to phishing-resistant MFA like FIDO2 security keys or passkeys, which cannot be approved by accident, and treat any push prompt the user did not just trigger as an active attack to report, not a glitch to ignore.
The attack starts with a password the victim does not know is stolen. It was phished, or bought from a breach, or guessed from a reused credential. The attacker logs in, the system sends a push approval to the victim's phone, and the victim declines it, because they are not logging in. Then it comes again. And again. Twenty times, fifty times, at two in the morning, until the victim taps approve just to make the phone stop buzzing. That tap is the whole attack.
MFA fatigue, or push bombing, has become the standard way around multi-factor authentication, because it attacks the human, not the cryptography. The factor is not broken. The person is tired. Security teams that treat it as a user error problem are missing the point: the design is the vulnerability, and the fix is a design change.
The attacker needs two things: a valid password and the victim's phone number or device registration. The password comes from phishing, credential stuffing, or a breach dump. The device comes from the MFA enrollment itself, which the attacker can see once they log in with the password. Then the attack is a script: trigger a push, wait for a decline, trigger another, for hours, until the victim approves out of exhaustion or confusion.
The timing is deliberate. Attackers run the flood late at night or during a meeting, when the victim cannot think clearly and just wants the buzzing to stop. Some add a social engineering layer: a fake IT message saying the prompts are a system error and to approve the next one to clear it. The victim who approves once has handed over the account, and the attacker changes the password and the MFA enrollment within minutes.
Push approval is a single tap on a screen the victim is not looking at carefully. It asks nothing of the user except to press a button, and it gives no context about what is being approved, where the login is coming from, or whether the user just tried to log in. A victim who declined ten prompts and approves the eleventh is not making a security decision. They are ending an annoyance.
CISA's guidance has moved toward phishing-resistant MFA for exactly this reason: FIDO2 security keys and passkeys cannot be approved by accident, because they require the user to be on the real site, with the real device, in the moment. A number-matching prompt, where the user must type the digits shown on the login screen, is a partial fix, but it still relies on the user noticing that the numbers do not match a login they never started. The key is the fix that removes the decision entirely.
Treat any push prompt the user did not just trigger as an active attack, not a glitch. The user should decline it, report it, and change the password from a different device immediately. The security team should check the login logs for the source IP and the time, and look for a password change or MFA enrollment change in the minutes after the approval, because that is the attacker's next move.
Then fix the design. Move high-risk users to security keys or passkeys first, then roll the change out to everyone. Set a limit on consecutive push prompts, so the tenth decline locks the prompt for an hour instead of sending an eleventh. And train users on one rule, not ten: if you did not just try to log in, decline the prompt and report it. The rule works because it is simple, and the attack works because the design is not.
Two earlier posts on this site cover ground “MFA Fatigue: The Push Notification Attack That Wears People Down” builds on: Fake Ticket Listings: The Resale Checks That Catch Most Scams, Fake Charity Scams After a Disaster: How to Check Before You Give, and Counterfeit Listings on Marketplaces: How to Report Them, and What Actually Gets Taken Down.
An attack that floods a user with MFA approval prompts until they tap approve just to stop the noise, usually late at night. The attacker already has the password and needs only that one approval to get in, then changes the password and the MFA enrollment within minutes.
Switch to phishing-resistant MFA like FIDO2 security keys or passkeys, which cannot be approved by accident. As a partial fix, use number-matching prompts and limit consecutive push requests, so the tenth decline locks the prompt instead of sending an eleventh.
Decline it, report it to IT, and change the password from a different device immediately. Then check whether the attacker changed the password or the MFA enrollment in the minutes after the prompt, because that is the next move.
No. SMS codes can be phished and intercepted, and push approvals can be fatigue-attacked. CISA recommends phishing-resistant MFA, meaning FIDO2 keys or passkeys, because they tie the authentication to the real site and the real device, and cannot be approved by accident.