MFA Fatigue / Push Bombing

Push-based MFA ("tap Approve") is convenient but socially attackable. If an attacker already has the victim's password (from reuse, phishing, or a breach), they can trigger approval prompts repeatedly.

How it works

The attacker logs in with the stolen password, which fires a push to the victim's phone. They repeat it — dozens of prompts, often at 3 a.m., sometimes paired with a call impersonating IT ("approve to stop the alerts"). Eventually the victim taps Approve out of confusion or fatigue. This technique featured in several high-profile 2022–2024 breaches.

How to test / detect

Review whether unlimited push prompts can be triggered, whether prompts show context (location, app, number matching), and whether repeated denials lock the flow. Detection: alert on bursts of MFA prompts and repeated denials.

Impact

Full account access despite MFA being enabled — the human is the bypass.

Defenses

• Number matching and rich context (app, location) on prompts.
• Rate-limit and lock after repeated denials; alert the user/SOC.
• Prefer phishing-resistant factors (FIDO2/passkeys) that can't be approved by mistake.