MFA fatigue (push bombing)

In short: In MFA fatigue an attacker with a stolen password floods the victim with login confirmations until they approve in annoyance or by accident.

In more detail: It bypasses two-factor login by attacking human weakness instead of technology. Methods with simple push confirmation are affected.

In Depth

• Sequence: With the stolen password a login is triggered repeatedly. The phone shows “Approve sign-in?” dozens of times, often at night. The attacker may also call, posing as IT support.
• Counter-measure “number matching”: The victim must type a number shown on the login screen into the app. A blind “yes” is not enough.
• Better: Phishing-resistant methods such as FIDO2/passkeys and security keys, which are bound to the real website.
• Behaviour: Always deny a request you did not trigger yourself and change the password. Never give IT support codes or approvals over the phone.
• Organisation: Limit attempts, alert on unusual locations, a reporting route for suspicious requests.

See also: MFA, two-factor authentication