This guide explains what MFA fatigue attacks are, how they unfold, the warning signs, and the specific settings and habits that stop them. Silicon Overdrive helps small, midsize, and enterprise businesses secure their identities and accounts, and these are the same recommendations we give our Customers.

What Is an MFA Fatigue Attack?

An MFA fatigue attack, also called push bombing or MFA bombing, is when an attacker who already has someone’s password sends repeated MFA approval requests to that person’s phone. The goal is to annoy, confuse, or pressure the user into approving one request, which gives the attacker access to the account.

The attack targets push-based MFA, where the user simply taps “Approve” or “Deny” in an authenticator app. Because it requires no technical exploit, it can be carried out by attackers with modest skills.

How Does an MFA Fatigue Attack Work?

An MFA fatigue attack starts with a stolen password and ends with a single mistaken tap. The attacker signs in again and again, triggering a flood of push notifications, and often adds pressure with a message or phone call that pretends to come from IT. One approval is all it takes.

1. The attacker obtains a password. This usually comes from phishing, malware, a data breach, or password reuse across sites.
2. The attacker tries to sign in. Each attempt sends an MFA push request to the real user’s phone.
3. The prompts keep coming. Dozens of requests may arrive in a short period, often outside working hours when the user is tired or distracted.
4. Pressure is added. The attacker may contact the user by phone, text, or a collaboration tool, posing as IT support and asking them to approve the prompt to “fix the issue.”
5. The user approves. The attacker gains access and may register their own MFA device to keep it.

Why Do MFA Fatigue Attacks Matter to Businesses?

MFA fatigue attacks matter because they turn a trusted security control into a way in. Once an attacker approves their way into one account, they can reach email, cloud apps, and internal systems, often while appearing to be a legitimate employee. That makes the activity harder to detect and the damage harder to contain.

This tactic has been linked to well-known breaches, including the widely reported 2022 Uber incident, where an attacker reportedly combined repeated MFA prompts with a message posing as IT support. [Verify: confirm details and link to a reputable source.]

The risk applies to organizations of every size. Smaller businesses often use default MFA settings that allow simple approve-or-deny prompts, while larger enterprises have thousands of users, so the odds that one person approves a prompt by mistake are higher.

What Are the Warning Signs of an MFA Fatigue Attack?

The clearest warning sign is an MFA prompt you did not request, especially several in a row. Any unexpected approval request means someone may already have your password. Employees should deny the request, avoid approving it under any pressure, and report it to IT or security immediately.

Other signs to watch for include:

• Prompts at unusual times. Requests that arrive late at night, early in the morning, or while you are on vacation.
• Prompts from unfamiliar locations. Some apps show the location or device of the sign-in attempt, which may not match where you are.
• Contact from “IT” about the prompts. A call or message asking you to approve a request is a strong sign of an attack. Real IT teams do not ask you to approve prompts you did not start.
• Unexpected password reset or account alerts. These may mean the attacker is testing your account.
• New devices on your account. A device you do not recognize listed in your MFA or account settings needs immediate attention.

How Can Businesses Prevent MFA Fatigue Attacks?

Businesses prevent MFA fatigue attacks by removing simple approve or deny prompts, adopting phishing-resistant MFA, limiting repeated requests, and training employees to report unexpected prompts. Combining stronger MFA settings with monitoring and a clear response process closes the gap that push bombing exploits.

• Turn on number matching. The user must type a number shown on the login screen into their app, so a prompt cannot be approved blindly.
• Show additional context. Display the app name, location, and device with every request so users can spot sign-ins that are not theirs.
• Move to phishing-resistant MFA. FIDO2 security keys and passkeys are bound to the real website and cannot be approved by mistake, making them the strongest option for administrators and executives.
• Limit and monitor push requests. Set thresholds that block or alert after repeated failed or denied prompts. Our managed detection and response services can watch for this activity around the clock.
• Use conditional access. Block sign-ins from unfamiliar countries, risky networks, or unmanaged devices.
• Protect passwords too. A password manager, unique passwords, and breach monitoring reduce the stolen credentials that start these attacks.
• Train and empower employees. Teach everyone to deny and report unexpected prompts, and to hang up on anyone who asks them to approve one.

Not sure how your current MFA is configured? Ask Silicon Overdrive for a review of your identity security settings.

Frequently Asked Questions

Is MFA Still Worth Using If Attackers Can Bypass It?

Yes. MFA blocks the large majority of password-based attacks. MFA fatigue attacks target weaker push settings, so the answer is to strengthen MFA with number matching or phishing-resistant methods, not to remove it.

What Is Push Bombing?

Push bombing is another name for an MFA fatigue attack. The attacker floods a user with push notifications from an authenticator app, hoping the user will approve one out of frustration or confusion.

What Should an Employee Do After Accidentally Approving a Prompt?

They should contact IT or security immediately. The team can end active sessions, reset the password, remove unknown MFA devices, and review the account for suspicious activity. Speed matters more than anything else.

What Is Phishing-Resistant MFA?

Phishing-resistant MFA uses methods such as FIDO2 security keys and passkeys that are tied to the legitimate website. They cannot be approved from a fake page or by tapping a push prompt, which makes them highly effective against MFA fatigue and phishing.

Does Number Matching Stop MFA Fatigue Attacks?

Number matching stops most of them, because the user must enter a code shown on the real sign-in screen, which the attacker controls and the user cannot see. Attackers may still try to trick users into reading out the code, so training remains important.