What Is MFA Fatigue?
MFA fatigue is an attack where someone who already has your password triggers repeated multi-factor authentication prompts, hoping you will approve one just to make them stop. It is also called push bombing or MFA prompt bombing. The attack works because an approval prompt feels like a nuisance, not a decision.
How attackers exploit it
The attacker first obtains a password through phishing or a breach. When they sign in, your phone receives an approval prompt. Then they repeat it, often at inconvenient times, sometimes with a follow-up call or message pretending to be IT support asking you to approve the prompt. One tap on approve hands them the account.
What to do
An approval prompt you did not trigger is a deny, every time:
- Never approve a sign-in prompt you did not start yourself.
- Repeated prompts mean your password is known: deny, change the password and report it.
- Treat any call or message asking you to approve a prompt as an attack, even if it sounds like IT.
- Report the pressure to your security team so they can lock the account and investigate.
Clarity before
the next step.
Is MFA fatigue the same as push phishing?
They are closely related. Push phishing is any attack that abuses push-based approval prompts. MFA fatigue is the version that relies on repetition and pressure until someone approves.
Does MFA still protect me?
Yes. MFA stops attackers who only have your password, as long as unexpected prompts are denied. The habit that matters is simple: you did not start a sign-in, you do not approve.
Can you train staff against MFA fatigue?
Yes. Push phishing simulations rehearse the exact moment an unexpected prompt arrives, with coaching that reinforces deny and report.