MFA Fatigue

MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the user accepts one, by accident or to make them stop. MITRE ATT&CK tracks it as T1621, Multi-Factor Authentication Request Generation.

CISA's October 2022 fact sheet recommends phishing-resistant MFA first and, where push has to stay, number matching as "one of the best interim" mitigations: the user must type a number shown on the sign-in screen into the app, so a prompt cannot be approved by someone who is not looking at that screen. Microsoft now applies number matching to all Authenticator push notifications with no user opt-out, and NIST SP 800-63B-4 no longer accepts out-of-band methods where the user compares two codes and taps approve, citing "authentication fatigue" attacks, and tells verifiers to limit the rate or number of push notifications. Number matching stops blind approval, not a phishing proxy that shows the victim the real number, which is why the end state is a passkey or security key with no prompt to approve. The 2022 Uber breach is the best-known case.

See also: MFA fatigue and push bombing technique, MFA fatigue breaches, phishing-resistant MFA, MFA, vishing, number matching, phishable MFA, talk-past attack