MFA Fatigue: When Too Many Prompts Become a Security Risk

Multifactor authentication (MFA) is one of the most effective ways businesses can add protection to their accounts. But like any security measure, the way MFA is implemented matters.

One increasingly common tactic is MFA fatigue, sometimes called MFA bombing or push bombing. Instead of trying to defeat MFA technically, attackers attempt to convince the person using it to approve a fraudulent login request.

The idea is simple: send enough notifications that the user eventually clicks “Approve” just to make the interruptions stop.

What Is MFA Fatigue?

MFA fatigue occurs when an attacker has obtained a user's username and password and repeatedly sends MFA authentication requests to that user's device.

The attacker is essentially hoping the user will:

• Accidentally approve the request
• Assume the prompt is legitimate
• Approve it because they're tired of receiving notifications
• Approve it simply to make the notifications stop
• Contact someone for help and inadvertently reveal information

Once an attacker gets an approved MFA request, they may be able to access the account and potentially use that access to reach email, files, applications, or other business resources.

CISA specifically identifies push bombing as a technique attackers can use to create MFA fatigue and recommends organizations move toward phishing-resistant MFA.

Don't Approve What You Didn't Request

One of the simplest ways to reduce the risk of MFA fatigue is also one of the most important: If you didn't attempt to sign in, don't approve the MFA request.

An unexpected authentication notification should be treated as a warning sign, not an inconvenience.

Employees should be encouraged to:

1. Deny the request.
2. Do not enter or share an MFA code.
3. Do not approve additional requests if they continue.
4. Report the unexpected request to the appropriate IT or security contact.
5. Change the password if there is reason to believe the account credentials may have been compromised.

Employees shouldn't be made to feel like they're causing trouble by reporting an unexpected MFA notification. Reporting suspicious activity quickly can help an organization investigate a potential compromise before it becomes something more serious.

Use Stronger MFA Methods

Not all MFA methods provide the same level of protection.

CISA recommends that organizations work toward phishing-resistant MFA. When phishing-resistant MFA isn't immediately available, CISA recommends considering number matching as an improvement over simple push notifications.

With number matching, a user is presented with a number during the sign-in process and must enter that number into their authenticator application. This makes it more difficult for an attacker to succeed simply by repeatedly sending approval requests.

Organizations should evaluate the MFA options available within their applications and prioritize stronger authentication methods for sensitive and privileged accounts.

Protect the Password Behind the MFA

MFA fatigue often starts with an attacker already possessing a user's username and password.

That means MFA shouldn't be treated as a replacement for good password practices.

Businesses should consider:

• Requiring strong, unique passwords
• Using a password manager
• Preventing password reuse
• Protecting administrative accounts with stronger authentication
• Reviewing accounts for suspicious sign-in activity
• Removing unnecessary or inactive accounts
• Using conditional access and risk-based policies where available

MFA is an important layer of defense, but protecting the credentials that come before it is important too.

Train Employees to Recognize the Attack

Technology can help reduce MFA fatigue, but employees still need to understand what an unexpected authentication request means.

Employees should know that legitimate IT staff should never ask them to approve an MFA request they didn't initiate. They should also understand that attackers may use urgency, repeated notifications, phone calls, or other social-engineering tactics to convince them to approve a request.

Regular security awareness training can reinforce these behaviors and help employees recognize that reporting suspicious activity is part of their role in protecting the organization.

Review Your MFA Configuration

Businesses should also take a closer look at how MFA is configured across their environment.

Consider asking:

• Which accounts have MFA enabled?
• Which accounts still rely on passwords alone?
• Are administrative and privileged accounts using stronger MFA?
• Can users be protected with number matching?
• Can phishing-resistant authentication be implemented?
• Are unexpected authentication attempts being logged and monitored?
• Are former employees' accounts disabled promptly?
• What happens when an employee reports an unexpected MFA request?

These questions can help identify opportunities to strengthen authentication before an attacker has an opportunity to exploit them.

MFA Is Still Worth It

MFA fatigue is a reminder that cybersecurity is rarely about one single technology. Attackers continually look for ways around security controls, and sometimes the easiest way around a technical defense is to target the person using it.

That doesn't make MFA ineffective. It makes thoughtful MFA implementation and employee awareness even more important.

CISA continues to recommend MFA because it provides an important additional layer of protection, while encouraging organizations to move toward stronger, phishing-resistant authentication methods.

For businesses, the goal should be a layered approach: strong authentication, secure passwords, appropriate access controls, employee training, monitoring, and a clear process for responding to suspicious activity.

The next time an unexpected MFA notification appears, don't just make it go away. Stop, deny it, and report it. That simple habit could prevent an attacker from getting through the door.