MFA Fatigue Attacks

Layer 8: People High risk

How it works

Multi-factor authentication stops most password attacks, but push notifications that ask a simple Approve or Deny can be abused. Once an attacker has a valid password, often from phishing or a previous breach, they repeatedly attempt to sign in. Each attempt sends another prompt to the real user's phone, sometimes late at night. The flood of requests is designed to wear the person down rather than to trick them with a convincing story.

Eventually a tired or confused person may approve one just to make the notifications stop, or because they assume it is a system glitch. Some attackers add a phone call or message pretending to be IT and asking the user to accept the prompt. Once approved, the attacker has a valid session and can register their own MFA method to keep access.

Warning signs

• Many sign-in prompts you did not initiate
• Prompts arriving at odd hours or in rapid succession
• A call or message asking you to approve a prompt
• Sign-in locations shown in the app that are not yours
• New MFA methods added to your account

How to defend against it

• Enable number matching and location context on push prompts
• Move high-risk users to phishing-resistant MFA such as passkeys
• Alert on repeated MFA denials and unusual sign-ins
• Teach staff to deny unexpected prompts and report them
• Use conditional access to block risky locations and devices

If it happens to you

1. Deny the prompts and report them to IT immediately
2. Change your password, since the attacker already has it
3. Have IT revoke sessions and review registered MFA methods
4. Check the account for changes made after any approval