What is MFA fatigue?
MFA fatigue, also called push bombing, is an attack in which someone who already has a person’s password sends repeated MFA push prompts until the person approves one to make them stop, or because a caller posing as IT tells them to.
How it works
The attack works against simple approve-or-deny prompts. Number matching, which asks the user to type a number shown on the sign-in screen, and phishing-resistant MFA make it far harder.
An unexpected MFA prompt is itself a signal: it means someone has the password. People should deny it and report it.
Why it matters
MFA fatigue turns the control people trust into the way in. Teaching people to treat an unexpected prompt as an alarm and report it is a fast win.
