An MFA fatigue attack is when attackers flood your account with real MFA prompts, push notifications, phone calls, or text codes, until you get annoyed or confused enough to approve one. The fix in the moment is simple: never approve a prompt you did not trigger yourself. Deny it, then move fast.
-
Right now: deny the prompt, do not tap “approve” out of habit.
-
Next: change your password from a device you trust and check active sessions.
-
Then: read the hardening section below and switch to passkeys or a hardware key where you can.
Quick fact: Microsoft’s own data shows that number matching and added context on push prompts eliminated MFA fatigue attacks in the environments where they turned it on.
Key Takeaways
Phishing-resistant MFA, passkeys and hardware keys, stops fatigue attacks that push notifications and SMS codes cannot.
| Point | Details |
|---|---|
| Deny, don’t approve | Never tap approve on an MFA prompt you didn’t trigger yourself, no matter how many arrive. |
| Password reset isn’t enough | Revoke active sessions and re-enroll MFA, since AiTM attacks can hijack tokens even after a password change. |
| Number matching works | Entering a displayed code instead of tapping yes/no eliminated fatigue attacks in Microsoft’s tested environments. |
| Passkeys beat SMS | FIDO2/WebAuthn keys cryptographically bind logins to the real site, stopping relay and SIM-swap attacks. |
| Stay alert with Scruteon | Scruteon’s free newsletter flags emerging social engineering tactics paired with MFA fatigue attempts. |
Table of Contents
How MFA Fatigue Attacks Actually Work
The attack starts with something boring: a stolen password. Attackers buy or phish your login credentials, then use them to trigger your account’s real MFA prompt, over and over, hoping you approve one out of confusion or irritation.
The pattern usually plays out like this:
-
Credential theft. A phishing email, a leaked password dump, or an infostealer gives the attacker your username and password.
-
Push bombing. They log in repeatedly, firing off dozens of legitimate push notifications, SMS codes, or automated calls until you tap “yes” just to make the noise stop.
-
Social engineering add-on. Some attackers follow up with a phone call posing as IT support, walking you through “verifying” your identity by approving the exact prompt they just sent.
-
Session hijacking variants. More advanced versions use adversary-in-the-middle (AiTM) relays that steal your session token after a real login, bypassing MFA entirely rather than begging for it.
MITRE catalogs this behavior formally as technique T1621, multi-factor authentication request generation. It is not theoretical. The Uber breach linked to the Lapsus$ group, a 2024 wave of Apple device prompt-bombing, and incidents affecting Cisco and Microsoft customers all followed this same script: steal credentials, spam the prompt, wait for fatigue to win.
What to Do the Moment You See an Unexpected Prompt
Speed matters more than perfection here. Work through these steps in order.
-
Deny every prompt you did not request. Do not approve “just to see what it is.” If your app has a “this wasn’t me” option, use it.
-
Change your password immediately, from a device you know is clean, not the one that might be compromised.
-
Revoke active sessions in your account’s security settings. Most major services (Google, Microsoft, Apple) let you sign out of all devices from one screen.
-
Check your recovery contacts and security questions. Attackers who get partial access sometimes swap in a recovery email or phone number they control.
-
Look for unknown devices and forwarding rules. A stray inbox rule that forwards mail to an unfamiliar address is a classic sign of a deeper compromise.
-
Report it. Tell the service provider through its official security channel, and if money or personal data was exposed, file a report with the appropriate consumer protection authority.
Pro Tip: Set a personal rule: if you get more than one MFA prompt you didn’t trigger, treat it as a live incident, not a glitch. Change your password before you even ask “why is this happening?”
Attackers count on the two or three seconds it takes you to think “maybe I forgot I logged in somewhere.” You didn’t. Trust the first instinct.
Which MFA Methods Actually Stop Fatigue Attacks
Not all MFA is built the same, and the type you use determines whether you’re an easy target or a hard one.
SMS and voice codes are the weakest link. They’re vulnerable to SIM-swap fraud, where an attacker convinces your carrier to move your number to their device, and they carry no context about whether the login request is legitimate. CISA has flagged phishing-resistant MFA as the direction every user and organization should be moving toward, precisely because it cryptographically ties your login to the actual website, not to a code that can be relayed or intercepted.
Push-only approval (the “tap yes or no” style) is only slightly better. It’s fast and convenient, which is exactly why it’s exploitable, since a tired or distracted user can tap approve by reflex.
Number matching closes that gap. Instead of a blind yes/no, you have to enter a code shown on your screen back into your authenticator app. This one change dramatically cuts accidental approvals, because it forces a moment of real attention instead of muscle memory.
Passkeys and hardware security keys (FIDO2/WebAuthn) are the strongest option available to individuals today. They bind your login cryptographically to the real site, so even a perfect phishing replica can’t trick your key into approving a session on the attacker’s server. This is what stops AiTM relay attacks cold, something SMS and push notifications simply cannot do.
Practical steps you can take this week:
-
Turn on number matching wherever your bank, email, or work account offers it.
-
Set up a passkey for your primary email account and any financial app that supports one.
-
Buy a hardware key (from a reputable vendor) for your most sensitive accounts if you want the strongest option available.
-
Remove SMS as a backup method once you’ve added something stronger, since attackers often target the weakest enrolled method, not the strongest.
How to Tell If an Attack Succeeded, and How to Fully Recover
A denied prompt doesn’t always mean you’re safe. Watch for these signals over the following days:
-
A sudden spike in login or MFA prompt volume, especially at odd hours.
-
New devices or browsers listed in your account’s login history that you don’t recognize.
-
“Impossible travel” alerts, a login from a state or country you weren’t in.
-
New forwarding rules or filters quietly added to your email.
If any of these show up, a password change alone is not enough. Session token replay from AiTM attacks means an attacker can still hold a valid, authenticated session even after you change your password, since the token itself, not just your credentials, needs to be invalidated. Log out of all devices, not just the one you’re using. Re-enroll your MFA method from scratch rather than trusting the old one still works cleanly.
For consumer accounts, report suspected identity theft or fraud to the FTC and, for anything involving financial loss, to the FBI’s IC3. OWASP’s guidance also stresses treating MFA re-enrollment itself as a high-risk action, since a poorly secured recovery flow is often how attackers get back in after being kicked out once.
Why Scruteon Watches This Closely
Scruteon exists to catch scam tactics as they evolve, and MFA fatigue attacks are a moving target. Attackers adjust their scripts constantly, swapping vishing calls for text-based social engineering the moment users catch on to one version.
Habits worth building into your routine:
-
Bookmark your login pages directly instead of clicking email links to reach them.
-
Never approve a prompt you didn’t personally trigger, no matter how official the follow-up call sounds.
-
Move to passkeys or a hardware key on your most important accounts as soon as the option appears.
If you’re ever unsure whether a message, call, or prompt you received is part of a real attack, Scruteon’s “Is This a Scam?” channel offers free, personalized advice on exactly that kind of situation.
Pro Tip: Screenshot suspicious prompts before you deny them. If you need to report the incident later, that timestamp and detail will matter.
The Real Lesson Buried in the Technical Advice
Most advice about MFA fatigue attacks focuses on what companies should configure, number matching, rate limits, conditional access policies. That’s useful, but it puts the burden on infrastructure you don’t control. For an individual reader, the actual leverage point is smaller and more personal: the two seconds before you tap “approve.”
Conventional wisdom treats MFA as a solved problem once it’s turned on. It isn’t. SMS and plain push approval were designed for convenience, not resistance to a determined, patient attacker willing to send fifty prompts at 2 a.m. The honest takeaway from CISA and Microsoft’s own guidance is that the strength of your MFA depends entirely on which type you’re using, and most people are still on the weakest version by default.
Prioritize this: enable a passkey on your email account today, since email is the recovery key to almost everything else you own online. Everything else, number matching, hardware keys, session monitoring, matters, but email comes first.
— Winston
Stay a Step Ahead of the Next Attack Tactic
Knowing how to react to one MFA prompt is good. Knowing what the next scam tactic looks like before it hits your inbox is better, and that’s the gap Scruteon’s free newsletter fills.
Scruteon sends short, plain-language alerts on real, current scams, including the social engineering tricks attackers pair with MFA fatigue attempts, like fake IT support calls or spoofed login pages. You get the explanation and the warning signs in a couple of minutes, not a security briefing you need a dictionary for. If a login prompt, text, or call ever feels off and you want a second opinion, Scruteon’s Is This a Scam? advice channel will look at it for free. Community organizations wanting a deeper look at why these attacks specifically target shared logins can also check this security and trust breakdown.
Start by subscribing to the free scam prevention guide and get the next alert before the next attacker tries their luck.
The information in this article is for educational purposes only. Scam tactics change fast, and we cannot guarantee that this information is always complete or up to date.