News Article · 2 min read
Why MFA Fatigue Attacks Keep Succeeding Against Well-Defended Organizations
Push-notification MFA fatigue — spamming a user with approval requests until they tap 'approve' out of frustration — keeps working against organizations that have already deployed MFA correctly.
MFA fatigue (also called "push bombing") doesn't defeat MFA technically — it defeats the human on the other end of it. An attacker with a valid, phished password triggers repeated push notifications, often at inconvenient hours, until the target approves one just to make the notifications stop, or mistakes it for a legitimate login they forgot about.
What actually stops it
- Number-matching MFA (the user must enter a number shown on the login screen into the authenticator app) rather than a simple approve/deny push — this defeats fatigue attacks directly.
- Phishing-resistant authentication (FIDO2/WebAuthn hardware keys or platform authenticators) removes the pattern entirely, since there's no push notification to fatigue someone with.
- Rate-limiting and anomaly detection on repeated MFA challenges to the same user in a short window.
Practical next step
If your organization still uses simple push-approve MFA for anything sensitive, number-matching is a real, low-cost upgrade most identity providers already support — it's a configuration change, not a new purchase, for most enterprise IdPs.