MFA fatigue is what happens when an attacker who already has an employee's password floods their phone with multi-factor authentication approval prompts until one gets accepted by accident — or out of sheer annoyance. Security teams call it push bombing or prompt bombing. It defeats the single control most businesses believe protects them, and it works for one simple reason: it attacks the person, not the code. Security awareness training that teaches staff to deny unrequested prompts and report them is the control that stops it, and this page explains exactly how the attack works, what the guidance says, and what to train.
TL;DR
- MFA fatigue = repeated push notifications until a user approves an attacker's login.
- It only works after a password is already stolen — it is the second half of a credential attack.
- ASD and the Five Eyes agencies have documented real campaigns built entirely on push bombing.
- Australian guidance flags push notifications and SMS codes as the methods most exposed to MFA fatigue.
- Numbered MFA, push number matching, and a trained 'deny and report' reflex close the gap.
What is MFA fatigue, precisely?
Multi-factor authentication asks for a second proof of identity beyond the password — usually a code or an approval prompt on the employee's phone. Push approval is the most convenient variant: a notification arrives, the user taps Approve, and they are in. Convenience is why it spread, and convenience is the opening the attack exploits.
In an MFA fatigue attack, the sequence runs like this:
- The attacker obtains a valid password — bought from a credential-stuffing dump, phished weeks earlier, or reused from another service that was breached.
- They enter it into the real login page. The password works, so the system sends a push notification: 'Approve sign-in?'
- The attacker spams the Approve request — sometimes dozens of times, at all hours — until the employee, worn down or half-asleep, taps Approve to make it stop.
- The attacker is inside a legitimate account with a legitimate session. No malware, no exploit, no alarm.
The employee is not careless in any normal sense. They are being deliberately harassed through the very feature that was supposed to protect them.
Why the guidance names push notifications specifically
Australian and allied guidance has moved on this fast. ASD's Essential Eight assessment guidance notes that organisations may want to avoid authentication methods increasingly subject to MFA fatigue or social engineering attempts, calling out push notifications and SMS codes by name (Essential Eight assessment process guide). At the highest maturity level the guidance expects phishing-resistant MFA instead.
The threat is not theoretical. A joint advisory from the FBI, CISA, the NSA, and ASD's Australian Cyber Security Centre documented Iranian state-linked actors who bombarded users with mobile push notifications until a request was accepted by accident or the notifications were stopped — alongside password spraying to harvest the credentials in the first place (joint advisory on Iranian brute force activity). When that technique appears in state-adjacent campaigns, it is past the point of being a niche trick.
The connection to everyday risk is the human element: roughly 60% of breaches involve a person — an error, a clicked link, or a manipulated decision (Verizon, 2026 DBIR). MFA fatigue is a human-element attack with a technical costume.
What MFA fatigue training must actually teach
Most security awareness training mentions MFA in one slide: turn it on. That is not enough, because the failure mode is not forgetting to enable MFA — it is approving a prompt the employee did not start. The training needs three behaviours, taught explicitly and rehearsed:
| Behaviour | What it looks like | Why it works |
|---|---|---|
| Never approve an unrequested prompt | A push arrives at 2am with no login in progress: deny it | Approval is the attack; denial ends it instantly |
| Deny AND report, every time | Hit deny, then flag the prompt through the reporting channel | The report tells IT an attacker holds the password |
| Understand what denial means | Denying a prompt you did not trigger means your password is compromised | Turns a confusing nuisance into a clear signal |
The third row is the one most training skips, and it matters most. An employee who denies a prompt and moves on leaves a stolen password live. An employee who denies and reports gives IT the one clue that lets them force a password reset before the attacker's second attempt lands. That reflex — deny, then report, without blame — is the whole defence.
It pairs with the reporting habit taught in phishing training: the same report-don't-reply instinct that catches a fake invoice catches a suspicious prompt. The channel differs, the habit is identical.
The technical half: what IT configures
Training handles the person; configuration handles the window the attacker needs. Three settings shrink the attack from plausible to impractical:
- Number matching. The approval prompt displays a two-digit number that must be typed into the login screen. A sleepy tap-through no longer works — the user must read a number they can only get from the genuine login page. Microsoft's number matching rollout made this the default posture for modern deployments.
- Phishing-resistant methods. Passkeys and FIDO2 security keys bind the sign-in to the real site, so a stolen password alone cannot generate a prompt at all. Guidance points here for high-maturity environments.
- Risk-based throttling. Conditional access rules that rate-limit repeated prompt failures stop the bombing loop itself: twenty failed approvals in ten minutes should trip the account, not the user.
None of these replace the trained reflex — they stack with it. A business that configures number matching and trains deny-and-report has closed both halves of the attack.
Why it belongs in the 90-day training plan
MFA fatigue slots into the credentials module of a staff curriculum — the same module that covers passphrases, password managers and credential reuse — but it deserves its own rehearsal moment, because the decision it demands is fast and counterintuitive. Two practical steps:
- Cover it in the first month, not the annual refresher. The attack needs only a stolen password and a distracted evening, and stolen-password rates mean every workforce has accounts already exposed.
- Rehearse with a scenario, not a memo. A one-minute scenario — 'it's 11pm, a prompt arrives, you didn't sign in anywhere — what do you do?' — trains the reflex far better than a policy paragraph.
Staff who click fewer simulated phishing emails and deny unrequested prompts are measured by the same instrument: per-person behaviour, trending monthly in human risk reporting. If your curriculum needs to satisfy a framework, the Essential Eight's multi-factor authentication strategies give the assessor's checklist the training records slot into.
FAQ
What is MFA fatigue in simple terms? An attacker with your password spams your phone with approval prompts until you tap Approve to make it stop — handing them the account.
Is MFA fatigue the same as push bombing? Yes. Prompt bombing and MFA fatigue are two names for the same technique: repeated MFA approval requests used to wear the user down.
Does MFA fatigue mean MFA doesn't work? No — it means one MFA method, plain push approval, is attackable. Number matching, phishing-resistant methods and a trained deny-and-report habit keep MFA among the strongest controls you have.
What should an employee do when they get an MFA prompt they didn't request? Deny it, then report it to IT immediately. The denial stops the login; the report tells IT the password is compromised and needs resetting.
Can attackers bypass number matching? Number matching removes the accidental-approval path, which is the path MFA fatigue depends on. Remaining attack routes require phishing the code itself, which is what phishing-resistant methods are for.
One last thing
If your business still uses plain push approvals, the fastest win available this week is a staff message with one sentence: 'We will never ask you to approve a sign-in prompt you did not start — deny it and tell IT.' It costs nothing, and it converts your most convenient control into a monitored tripwire.