Cybersecurity glossary
What is MFA Fatigue?
Learn what MFA fatigue is, how attackers spam push approvals until users accept, real-world impact, and defenses such as number matching and phishing-resistant authenticators.
Definition
MFA fatigue is an attack technique in which adversaries—often after stealing a password—flood a victim with repeated multi-factor authentication prompts until the user approves one out of confusion, frustration, or habit, granting the attacker access.
Why “just approve the push” became an attack
Push MFA was built for convenience: a phone tap confirms a login. Attackers noticed that humans under notification spam often tap anyway. MFA fatigue turns that UX into an exploitation path after credential theft.
High-profile intrusions have shown that “we had MFA” is not enough when the second factor is an easy Approve button.
How an MFA fatigue attack unfolds
Obtain primary credentials
Phishing, stuffing, purchase of leaked passwords, or help-desk reset abuse.
Trigger repeated MFA prompts
Automated logins generate push after push to the victim’s authenticator app.
Apply social pressure
Sometimes paired with calls or chat messages claiming IT needs an approval.
Victim approves one request
Fatigue, confusion, or urgency produces a single Allow tap.
Attacker session established
Tokens or SSO sessions are collected; persistence and lateral movement begin.
Why push MFA is uniquely exposed
Low-friction approvals
A single tap is easier to socially engineer than typing an origin-bound proof.
Notification overload
Dozens of prompts train users to clear alerts without reading context.
Ambiguous context
Generic ‘Are you signing in?’ messages lack strong transaction details.
Password reuse pipeline
Stuffing supplies the first factor at industrial scale.
Help-desk pretexts
Attackers claim the spam is an IT test the user must approve.
Session longevity
One tired tap can yield a long-lived SSO session.
Controls that reduce MFA fatigue success
| Control | Effect | Residual risk |
|---|---|---|
| Number matching | Requires code from login screen | User may read number to attacker |
| Rate limit MFA challenges | Stops prompt storms | Slower attacks may continue |
| Geo / risk blocks | Challenges never fire from odd paths | Residential proxies blend in |
| FIDO2 / passkeys | Removes tap-to-approve channel | Recovery paths must stay strong |
Defense checklist
- Prefer phishing-resistant MFA (passkeys, security keys) for privileged and remote access.
- Enable number matching or equivalent challenge detail for any remaining push MFA.
- Rate-limit MFA challenge generation per account and per source identity.
- Alert on MFA prompt bursts and approve-after-many-failures patterns.
- Train users: never approve unexpected pushes; report storms to security.
- Harden help desks against social engineering that requests MFA resets or approvals.
- Shorten session lifetimes after risky MFA events; require re-auth for sensitive apps.
- Combine with breached-password blocking to reduce first-factor compromise.
The practical takeaway
MFA fatigue exploits people, not cryptography. Endless push prompts convert a security control into annoyance—and annoyance into access.
Upgrade high-risk users to phishing-resistant authenticators, add matching and rate limits where push remains, and treat unexpected MFA storms as an incident, not a nuisance.
Related security terms
MFA Push Bombing
Closely related technique focused on high-volume push notification abuse.
Multi-Factor Authentication (MFA)
Broader MFA landscape that fatigue attacks specifically target.
Phishing-Resistant MFA
FIDO/passkey methods that remove approve-prompt attack surface.
Adaptive Authentication
Risk controls that can throttle or block suspicious MFA storms.
Credential Stuffing
Common way attackers obtain the password used before MFA fatigue.
Frequently asked questions
What is MFA fatigue in simple terms?
Attackers who already know your password keep sending login approval requests to your phone until you tap Allow just to make the alerts stop.
Is MFA fatigue the same as MFA push bombing?
They overlap. Push bombing emphasizes volume of push notifications; MFA fatigue emphasizes the human outcome—eventual approval under pressure.
Do I need a password for MFA fatigue to work?
Usually yes for classic push MFA. The attacker authenticates with stolen or guessed credentials, then abuses the second-factor prompt channel.
Why do users approve malicious prompts?
Alert overload, fear of being locked out, habit of approving work pushes, social engineering follow-ups, or mistaken belief the IT team is testing.
Does number matching stop MFA fatigue?
It greatly raises the bar because users must type a code shown on the login screen, not just tap Approve. Determined attackers may still social-engineer the number.
What is the strongest defense?
Phishing-resistant authenticators such as FIDO2 security keys and passkeys that do not rely on tap-to-approve prompts.
How can SOC teams detect MFA fatigue?
Look for bursts of MFA challenges, many failures followed by one success, unusual geolocation, and concurrent sessions after password spray events.
References
Explore authoritative guidance and frameworks related to mfa fatigue.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.