MFA fatigue, also called push bombing, is a social engineering technique aimed at push-notification multi-factor authentication. The attacker already has a valid password and repeatedly triggers login attempts, so the victim receives a stream of "Approve sign-in?" prompts. The hope is that they will tap approve to make it stop, or by mistake.
Why it matters
It shows that a second factor is only as strong as the user's decision at the prompt. Simple approve-or-deny pushes give no information about who is logging in. Organisations respond with number matching, where the user must type a number shown on the login screen, with context such as location and application name, with rate limits on prompts, and with phishing-resistant factors such as passkeys or security keys.
Example
An employee gets a dozen prompts at midnight. The policy they were trained on says never to approve a prompt they did not start and to report it. They deny each one, tell the help desk, and the password is reset before the attacker succeeds.
Common mistakes
- Approving unexpected prompts just to stop them.
- Not reporting the prompts, which would signal the password is stolen.
- Leaving simple push approval as the only option.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.