What is an MFA Fatigue Attack?

An MFA fatigue attack (also called push bombing) is a social engineering–driven cyberattack where attackers flood a user with repeated multi-factor authentication (MFA) requests until the user eventually approves one.

Instead of breaking authentication systems technically, attackers exploit human behavior. When users receive dozens of login prompts-often at inconvenient times-they may approve a request just to stop the notifications, unknowingly granting attackers access.

This attack highlights a critical weakness in traditional MFA implementations: even strong authentication mechanisms can fail when users are overwhelmed or tricked.

How MFA Fatigue Attacks Work

MFA fatigue attacks typically begin after attackers already have a user’s username and password (often obtained via phishing or data breaches).

Step-by-Step Attack Flow

• Attacker logs in using stolen credentials  
• The system triggers an MFA push notification  
• The attacker repeatedly attempts login, sending multiple MFA prompts  
• The user receives continuous notifications on their device  
• Out of confusion or frustration, the user approves one request  
• The attacker gains full access to the account  

This technique requires minimal technical effort but can be highly effective.

Why MFA Fatigue Attacks Are Effective

MFA fatigue attacks succeed because they exploit human psychology rather than system vulnerabilities.

Repeated notifications create urgency, confusion, and annoyance. Users may assume the requests are legitimate system glitches or accidental triggers. In some cases, attackers even follow up with social engineering calls or messages pretending to be IT support.

Additionally, many organizations rely heavily on push-based MFA, which-while convenient-can be vulnerable if not properly configured with safeguards.

Real-World MFA Fatigue Examples

MFA fatigue attacks are not theoretical-they have been used in high-profile breaches.

One well-known case involved a major ride-sharing company where attackers used MFA push bombing combined with social engineering to gain internal access. Similar techniques have been observed in attacks targeting financial institutions and enterprise environments.

These incidents demonstrate that even organizations with advanced security controls can be compromised through user manipulation.

How to Prevent MFA Fatigue Attacks

Preventing MFA fatigue attacks requires a combination of technical controls and user education.

Best Practices for Prevention

• Implement number matching MFA instead of simple push approvals  
• Limit or throttle repeated MFA requests  
• Use adaptive authentication to detect suspicious login attempts  
• Educate users to deny unexpected MFA prompts  
• Enable risk-based authentication policies  
• Monitor for unusual login behavior and alert users immediately  

Organizations should move beyond basic MFA toward more secure, context-aware authentication mechanisms.

Summary

MFA fatigue attacks exploit a simple but powerful weakness-human behavior. By overwhelming users with repeated authentication requests, attackers can bypass even strong security systems.

As MFA adoption grows, so does the need to strengthen how it is implemented. Combining user awareness with advanced authentication controls is essential to prevent these increasingly common attacks.

FAQs

Q1. What is an MFA fatigue attack in simple terms?

It is an attack where hackers spam authentication requests until a user accidentally approves one.

Q2. What is another name for MFA fatigue attack?

It is also called push bombing or MFA prompt bombing.

Q3. Do MFA fatigue attacks require hacking skills?

No, they mainly rely on stolen credentials and social engineering.

Q4. How can MFA fatigue attacks be prevented?

They can be prevented using number matching, limiting requests, and user awareness.

Q5. Is MFA still safe against attacks?

Yes, but it must be implemented securely with additional protection.