What is MFA Fatigue Attack?
MFA Fatigue Attack is a social engineering technique where an attacker who already has a victim's password sends repeated push notification approval requests until the user accepts one out of frustration or confusion. It bypasses multi-factor authentication without breaking any cryptography.
What it is
An MFA fatigue attack, also called MFA bombing or push bombing, exploits the human side of authentication. The attacker already holds valid credentials, usually stolen through phishing or a data breach. They trigger dozens or hundreds of push-based MFA prompts in a short window. The victim, overwhelmed or confused, taps "Approve" to make the noise stop. The attacker then has full access.
The attack requires no malware and no vulnerability in the MFA system itself. It abuses a design assumption: that a legitimate user will only approve prompts they initiated.
Why it matters
Push notification MFA is the most widely deployed second factor in enterprises. It replaced SMS codes because it is faster and harder to intercept. But speed and convenience are exactly what this attack exploits. Several high-profile breaches have been traced directly to MFA fatigue, making it a known, repeatable threat rather than a theoretical one.
Any organization using simple approve/deny push MFA is exposed. The risk is higher when employees work across time zones, use shared accounts, or receive many legitimate prompts daily.
How tools address it
Modern MFA and passwordless tools in the MFA and Passwordless category reduce or eliminate this exposure in several ways:
- Number matching: The app displays a code shown on the login screen. The user must type it into the prompt, so blind approval fails.
- Context display: The prompt shows the login location, device, and time. An unusual location makes the fraud obvious.
- Rate limiting and lockout: After a threshold of denied or unanswered prompts, the account is locked or flagged.
- Phishing-resistant factors: Passkeys, hardware security tokens, and biometric-bound credentials tied to a specific device never send an approvable push at all. There is nothing to spam.