In Short:
For years, businesses were told that multi-factor authentication (MFA) was the solution to account security. Even if someone stole your credentials, they wouldn’t be able to log in without that second step, usually a push notification on a phone.
MFA seems like the perfect solution to credential breaches. Today, attackers have found a way around it. Instead of breaking the technology, they target the person behind it.
This method known as MFA prompt bombing or an MFA fatigue attack has become one of the most effective ways to bypass modern security controls. To learn more about other MFA scams read here.
MFA prompt bombing is when an attacker repeatedly sends login approval requests to a user until they finally click “approve.”
MFA typically asks: “Are you trying to sign in? Approve or deny.”
MFA providers like DUO or Authenticator apps are typically very secure so rather than hacking into the system, attackers they rely on persistence and psychology. They overwhelm users with repeated notifications until the easiest option feels like making the alerts stop.
Step-by-step:
Step 1: The attacker obtains a password
Often from a data breach, reused credentials, or phishing
Step 2: They attempt to log in
This triggers the MFA process
Step 3: The user receives a push notification
Asking them to approve or deny the login
They deny since its not them
Step 4: The attacker repeats the login request
Again and again, sometimes dozens of times
Step 5: Eventually, the user clicks “approve”
Often just to make the notifications stop or by accident
Step 6: In some cases, attackers take it a step further by combining this with vishing (voice phishing):
They call the user pretending to be IT support. They say something like: “We’re seeing an issue with your account, can you approve the notification?”Because the request feels routine, many users comply.
Unfortunately MFA systems cant stop the push notifications just yet because:
MFA assumes the user can answer the is this you question without them flagging it as suspicious. But in reality, humans make mistake sometimes they are:
Many assume repeated prompts are just a system glitch, not an attack.
Most MFA notifications provide limited information, such as:
When notifications appear repeatedly:
If a user approves the request even accidentally the system:
From a technical standpoint, everything looks normal.
In 2022, attackers targeted a Cisco employee:
What happened next:
Let’s clear up a few common misunderstandings:
The good news: there are practical ways to reduce risk.
Consider switching from simple push approvals MFAs to:
Why it works:
These methods require active user input, not just tapping “approve.”
Practice good password posture and use tools that:
MFA prompt bombing usually starts with a stolen password, avoid this attack method all together by creating a strong password no one can guess. TO learn more about strong passwords read here.
For example:
This stops attackers before they can succeed.
If you do notice an abundance of MFA requests do not touch anything and report it to your IT department, so they can further assess the situation.
Multi-factor authentication is still a critical layer of security. But not all MFA is created equal. When systems rely too heavily on users making the right decision they become vulnerable.
Security fails when it depends on tired, distracted humans. Now is the time for organizations to:
It’s when users become desensitized to repeated authentication prompts and start approving them automatically.
Yes, but weaker methods like push notifications are more vulnerable to social engineering.
Passkeys, hardware security keys, and number code matching are more secure alternatives.
Not directly, but attackers can manipulate users into bypassing it.