MFA fatigue attacks, and how to train for a prompt you did not expect
An MFA fatigue attack happens when someone who already has your password spams approval prompts until a tired employee taps accept. CISA notes an attacker can generate hundreds of prompts in a short period. The durable fix is number matching, a configuration change, not a training message.
- MFA fatigue is a property of the factor, not of your staff. A plain approve-or-deny push can always be spammed. One that needs a number from the login screen cannot.
- CISA rates push without number matching as vulnerable to push bombing, and the same app with number matching as resistant. Same people, same phones, different setting.
- Microsoft enabled number matching for all Authenticator push notifications, but its own documentation says the Network Policy Server extension does not support it. Your email got fixed. Your VPN may not have.
- Cloudflare found about 41 percent of successful human logins involve leaked credentials, so an attacker holding a working password is normal rather than exceptional.
- A denied prompt is evidence, not a near miss. MFA runs after the password is accepted, so a denial means somebody currently holds a valid password for that account.
What is an MFA fatigue attack?
An MFA fatigue attack is a login attack in which somebody who already holds your password triggers approval prompts until a user taps accept. CISA describes it plainly. A threat actor who has obtained a password can generate hundreds of prompts on the user's device over a short period of time. The technique has a second name, push bombing, and a catalogue entry. MITRE lists it as T1621, Multi-Factor Authentication Request Generation.
The attack runs on timing and reflex rather than cleverness. Prompts arrive at 2am, or mid-meeting, or while somebody is already signing into three systems. CISA records that a user may press accept by accident or from MFA fatigue, or may assume one request is legitimate and approve it. A routine approve-or-deny push asks a tired person for a yes with no information attached.
Push bombing is not a vendor's hypothetical. It appears in documented intrusions investigated by the FBI. The joint advisory on Scattered Spider, co-signed by seven national agencies, records that the group uses multiple social engineering techniques including push bombing and SIM swap attacks to obtain credentials and bypass multi-factor authentication, and that actors sent repeated MFA notification prompts leading to employees pressing the Accept button.
This guide is for the person who buys and reviews the managed IT contract, not the person who configures the tenant. For the difference between the terms themselves, read MFA vs 2FA.
MFA fatigue is a property of the factor, not of the user
MFA fatigue is a property of the factor you chose, not of your staff. A simple approve-or-deny push can always be spammed, because approving it needs nothing the attacker does not already control. CISA's own ranking makes that point without blaming anyone. It rates mobile push notification without number matching as vulnerable to push bombing attacks as well as user error, and the same authenticator app with number matching as resistant to push bombing.
Same people. Same phones. Same training. Different setting, different outcome. That is what it means to say the weakness lives in the factor.
CISA sorts the options into four rungs, strongest to weakest.
- Phishing-resistant MFA. FIDO2 and WebAuthn security keys, passkeys, and PKI smart cards. CISA records push bombing, SS7 and SIM swap attacks as not applicable here.
- App-based with number matching. A one-time code from an authenticator app, a token code, or a push you approve by typing a number. Resistant to push bombing, still phishable.
- Push without number matching. A plain tap to approve or deny. Vulnerable to push bombing and to user error.
- SMS or voice. CISA says this form should only be used as a last resort MFA option.
Two things follow. The question to put to a provider is not whether you have MFA, because almost every business does. The question is which factor each system uses, and whether it can be approved without looking at anything. You can also climb a rung without buying anything, because number matching is a free setting inside licences you already pay for.
How does number matching stop an MFA fatigue attack?
Number matching stops the attack by moving the approval onto the screen the person is logging in on. Instead of a yes or no tap, the sign-in page shows a short number and the authenticator app asks the user to type it. CISA puts the effect in two clauses. It requires access to the login screen to approve requests, and each prompt generates a unique set of numbers for every login request.
Read that second clause again, because it carries the argument. The attacker can still spam you. The spam simply cannot be approved. A user who never sees the attacker's screen has no number to type, so the reflexive accept stops being a possible action. The control does not ask people to be more alert. It removes the button.
Be honest about the limit. CISA calls number matching one of the best interim mitigations for organizations that cannot immediately implement phishing-resistant MFA, and keeps it a rung below the top because the factor stays vulnerable to phishing attacks. A fake login page can still show a victim the number. Number matching ends push bombing, not phishing.
Microsoft already enabled it, and that is not the same as being covered
Microsoft made number matching the default, so most Microsoft 365 sign-ins got the fix with nobody deciding anything. Microsoft's documentation states that number matching is enabled for all Authenticator push notifications and that users cannot opt out. Plenty of businesses read that and treat the problem as closed.
The same page closes that assumption. It documents that the Network Policy Server extension does not support number matching, and that on unpatched Windows Server the AD FS adapter keeps the Approve and Deny experience. Number matching is also not supported on Apple Watch or Android wearable devices. Those are the legacy paths a smaller business keeps running, and the NPS extension is what puts MFA in front of a VPN login.
So the risk is narrower and more awkward than we have number matching. Your email was probably fixed by default. Your remote access may not have been. That gap matters, because the seven agencies behind the Scattered Spider advisory single out webmail, virtual private networks and accounts that access critical systems as the places to require phishing-resistant MFA first. Ask your provider to audit every place a push notification still appears, and to say which of them can be approved without reading a number.
What phishing-resistant MFA adds, and what it costs
Phishing-resistant MFA removes push bombing as a category rather than mitigating it. The seven agencies behind the Scattered Spider advisory recommend FIDO and WebAuthn authentication or PKI-based MFA because those implementations are not susceptible to push bombing or SIM swap attacks. CISA adds that FIDO and WebAuthn authentication is the only widely available phishing-resistant authentication.
A FIDO2 security key or a passkey holds a secret tied cryptographically to the real website. It releases nothing to a lookalike domain, and it gives the user nothing to approve by reflex, type into a fake page, or read out to a caller. Microsoft research across a large population measured that MFA reduces the risk of compromise by 99.22 percent.
Adoption is no longer exotic. The FIDO Alliance surveyed 11,000 consumers and 1,400 enterprise decision-makers across ten countries and found 68 percent of organizations have deployed or are actively deploying passkeys for employee sign-ins, while only 28 percent have achieved a fully passwordless workforce. Most buyers sit in that gap.
Sequence the rollout if the budget is small. CISA's phased advice starts with help desk and IT system administrator accounts, because those accounts reset everyone else's. Our guide to auditing your MSP's privileged access covers who holds them today. For everyone else, CISA says app or token one-time codes and push with number matching are the best options for small and medium-size businesses that cannot immediately implement phishing-resistant MFA.
A workable order of operations is listed below.
- Issue FIDO2 keys or passkeys to administrators, finance staff and anyone who can move money.
- Enforce number matching everywhere a push notification is still used, including VPN and remote access paths.
- Retire SMS one-time codes as a primary factor, keeping them only where nothing else works.
- Keep an authenticator app one-time code as the fallback for systems that cannot take a security key.
- Apply conditional access so a sign-in from an unmanaged device is blocked before any prompt is sent.
That last line is the cheapest win here. MITRE recommends both limiting the maximum number of MFA request prompts and using conditional access policies to block logins from non-compliant devices. A prompt that is never generated cannot be approved.
The upstream failure is that somebody had your password at all
Every MFA fatigue attack starts with a working password, which makes the password the upstream thing worth fixing. CISA names the usual routes in one footnote, noting an actor could acquire a password via password spraying, a password dump from a compromised site, or other methods. Those routes need a list, not skill.
The size of that list is the uncomfortable part. Cloudflare analysed authentication traffic across roughly a fifth of the web against a database of over 15 billion leaked records, and found approximately 41 percent of successful human authentication attempts involve leaked credentials. Password reuse is the thread connecting a breach at an unrelated retailer to a login at your company. Credential stuffing is the automated version, and 95 percent of those attempts came from bots.
Verizon's 2026 breach data puts credential abuse at 13 percent of breaches as an initial access vector, down from its previous position as the leader. That fall is good news and a trap. Credential abuse dropped partly because MFA now blocks the easy version, which is why attackers moved to techniques that defeat the second factor instead. Our password best practices guide covers the hygiene side.
One route never touches your login page. The Scattered Spider advisory records actors who posed as employees to convince help desk staff to reset a password and transfer the employee's MFA to a device they control. A stolen password and a reset password arrive in the same place, so how your help desk verifies a caller belongs in this conversation. Our post on the deepfake voice call your finance lead will receive covers that call.
Train for the right thing. An unexpected prompt is an incident report.
To train for a prompt nobody triggered, teach one rule and give staff one place to send it. The rule is that an approval request you did not start is an incident report, not an annoyance. CISA's training list runs to three items, covering MFA fatigue, how to recognise MFA spam, and how to report an unknown confirmation request.
The channel matters more than the lesson, because the lesson decays and the channel does not. Staff need somewhere to send an unexpected prompt in ten seconds, from a phone, at 11pm, without logging into anything. A shared mailbox nobody watches overnight fails that test. A number that reaches your provider's on-call engineer passes it.
The reason to care is written into CISA's guidance and easy to miss. MFA checks run after the first factor is satisfied, so CISA warns that a denied MFA request could mean the user's password is compromised and recommends organizations investigate the root cause. A denial is evidence that somebody currently holds a valid password.
The drill is five steps long.
- Deny the prompt. Never approve a request you did not start yourself.
- Report it immediately through the channel on the card, including at night.
- Change the password from a device you trust, never from a link in a message.
- Escalate to your provider so they can revoke active sessions and read the sign-in log.
- Confirm afterwards that nobody registered a new authenticator app or phone number.
Most drills skip that last step. The advisory records actors who register their own MFA tokens after compromising an account to establish persistence, so resetting the password alone can leave the attacker's second factor in the account. Report rate tells you whether any of this landed, and we cover why in report rate, not click rate.
Five questions to put to your provider this week
Five questions separate a provider who configured this from one who sold you a product name. Ask them in writing and keep the answers.
- Which factor does each system use today, and can any be approved without reading a number off the login screen?
- Where does a push notification still appear outside Microsoft 365, including VPN, remote access and any legacy AD FS path?
- Who holds a FIDO2 key or passkey today, and does that list cover every administrator and everyone who can move money?
- What happens when a user denies a prompt, who investigates it, and within how many minutes?
- How does your help desk verify a caller before it resets a password or moves a registered authenticator app?
A provider who operates the control answers with settings, names and minutes. One who sells a product answers with a vendor name. None of this buys perfect security, and no honest provider promises it. It buys a login that cannot be approved by reflex, and a report that reaches a human while the attacker is still trying.
A prompt you did not trigger is not a glitch. It is evidence that somebody already has the password.
FAQ
What is an MFA fatigue attack?
An MFA fatigue attack, also called push bombing, happens when an attacker who already holds a valid password triggers approval prompts repeatedly until somebody taps accept. CISA notes a threat actor can generate hundreds of prompts on the user's device over a short period of time. MITRE catalogues the technique as T1621.
Does number matching stop MFA fatigue attacks?
Yes. Number matching makes the user type a number shown on the sign-in screen, and CISA notes each prompt generates a unique set of numbers for every login request, so spamming prompts stops working. It does not stop phishing, because a convincing fake login page can still display the number.
Why am I getting MFA prompts I did not request?
Because somebody is entering your password right now. MFA runs after the password is accepted, so CISA warns that a denied MFA request could mean the user's password is compromised. Deny every prompt you did not start, report it to your IT provider immediately, then change the password from a device you trust.
Is a passkey better than an authenticator app?
Yes for resisting both push bombing and phishing. CISA states that FIDO and WebAuthn authentication is the only widely available phishing-resistant authentication, and the FBI-led Scattered Spider advisory records that those implementations are not susceptible to push bombing or SIM swap attacks. An authenticator app one-time code remains a reasonable fallback.
What should staff do when an unexpected MFA prompt arrives?
Deny it, then report it within seconds through a channel that reaches a human at night. CISA's training guidance covers MFA fatigue, how to recognise MFA spam, and how to report an unknown confirmation request. Afterwards, confirm that no new authenticator app or phone number was registered on the account.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on rating and verified data, and paid placement is always labelled. We do not sell IT services. Take the five questions above to three merit-ranked firms in your city.