MFA fatigue: when "just approve it" becomes the breach

Multi-factor authentication is one of the best security decisions most organisations ever make. It is also, in one specific configuration, the reason some of them get breached. The weak point is not the maths — it is the moment a tired human being is asked a yes-or-no question at the wrong time.

What happens

The attacker already has a working username and password. They did not need to break anything clever to get it: passwords leak through reused credentials, phishing pages and infostealer malware all the time. The password alone is not enough, because the account is protected by push-based MFA — the kind where your phone buzzes and you tap Approve.

So the attacker simply tries to log in. Over and over. Each attempt fires another push notification at the real account owner. Late at night, or during a busy morning, this becomes a stream of prompts with no obvious off switch. Eventually someone taps Approve — to make it stop, because they assume it is a glitch, or because they genuinely cannot remember whether they just opened the app.

That single tap is the whole attack. It is often paired with a phone call or a message from "IT support" explaining that the prompts are part of a system migration and the user should just accept the next one.

Why it matters to you

If your workplace uses push notifications as its second factor, you are the control. There is no filter sitting between the attacker's login attempt and your thumb. And this is not limited to corporate accounts — personal email, cloud storage and social accounts increasingly use the same pattern, and personal email is often the recovery path into everything else you own.

It also scales badly in your favour. An attacker can run this against hundreds of employees at once and only needs one person, once, to be tired enough.

How to spot it

• You get an MFA prompt you did not trigger. That is the entire signal. One unexplained prompt is a security event, not a glitch.
• Prompts arrive repeatedly, or in a burst, especially outside your normal working hours.
• Someone contacts you — by phone, chat or text — asking you to approve a prompt. Legitimate IT teams do not need you to approve a login they are performing.
• The prompt shows a location, device or app you do not recognise. Read the detail before deciding, not after.

Red: why the attacker likes this

It needs no malware, no exploit and no custom tooling. It leaves few of the traces defenders normally hunt for, because the successful login looks like a successful login. And it exploits something no patch fixes: notification fatigue. We are all trained by our devices to dismiss interruptions quickly.

Blue: what actually stops it

1. Number matching. Instead of Approve/Deny, the login screen shows a two-digit number that you must type into your phone. An attacker who cannot see your screen cannot tell you the number. Most major identity providers support this — it is usually one setting.
2. Phishing-resistant factors. Passkeys and hardware security keys remove the approval question altogether. There is nothing to approve by mistake.
3. Rate limiting and lockout. Cap how many prompts a single account can receive in a short window. An attacker who gets three attempts instead of three hundred has a much worse day.
4. Make reporting frictionless. People stay quiet when they think they will be blamed. If reporting an accidental approval is fast and blame-free, you find out in minutes rather than weeks.

If you already tapped Approve

It happens, and the first ten minutes matter far more than the apology. In order:

1. Change the password on that account immediately.
2. Sign out all active sessions — most providers have a "sign out everywhere" option. This is the step people forget, and it is the one that evicts the attacker.
3. Check for new MFA methods, forwarding rules or app passwords added to the account. Attackers add their own access so they survive your password reset.
4. Tell your security or IT team. Immediately, not tomorrow.

MFA is still worth having — overwhelmingly so. The lesson is not that it fails, but that the weakest version of it hands the final decision to the most distracted person in the building at the worst possible moment.