It is 11:40 on a weeknight and your phone lights up: approve sign in? You did not try to sign in, so you tap Deny. Thirty seconds later it asks again. Then again. By the tenth prompt you are annoyed, half asleep, and wondering if Microsoft is glitching. That moment is the whole attack. An MFA fatigue attack, also called push bombing or MFA bombing, happens when someone who already has your password floods your phone with approval requests until you accept one. This guide explains how the attack works, why careful people fall for it, two well documented cases, and the specific settings that stop it.
How a push bombing attack unfolds, step by step
The attacker starts with a working password. It may come from a phishing page, from infostealer malware that scraped saved passwords off a personal laptop, from a password reused on a site that was breached years ago, or from a criminal marketplace where stolen logins sell in bulk. The password alone should not be enough, because multifactor authentication asks for a second proof. With push based MFA, that second proof is a single tap on a phone.
So the attacker signs in again and again, and every attempt sends a fresh prompt to your device. MITRE ATT&CK, the public catalog of attacker techniques, tracks this as Multi Factor Authentication Request Generation, technique T1621. The timing is rarely random. Bursts land late at night, early in the morning, or in the middle of a hectic workday, when the target is least likely to stop and think.
Many attackers add a second layer of pressure: a phone call, text, or chat message from someone claiming to be the IT department, explaining that a system glitch is causing the prompts and that approving one will make them stop. Once the victim taps Approve, the attacker is inside. The usual next moves are registering the attacker's own phone as a new MFA method, creating inbox rules to hide replies, and searching email for invoices and payment threads.
Why careful people still tap Approve
People approve legitimate prompts many times a week, so the motion becomes a reflex. Microsoft says this plainly in its own guidance, warning that prompting users too often for reauthentication can increase the risk of users approving MFA requests they did not initiate. A prompt that interrupts sleep or a client call feels like a nuisance to clear, not a decision to weigh.
Exhaustion matters too. After the eighth or ninth prompt, the goal quietly shifts from protecting the account to making the buzzing stop. And authority does the rest. A calm voice saying "this is the help desk, just accept the next one" gives the victim a reason that sounds responsible. Older push prompts made things worse by showing almost no context, so a user could not tell a real background sign in from an attacker's attempt.
Uber and Cisco: two documented MFA fatigue breaches
In September 2022, Uber reported that an attacker had compromised an external contractor's account. Uber said the attacker likely bought the contractor's corporate password on the dark web after malware infected the contractor's personal device, then repeatedly tried to log in, triggering approval requests that were blocked at first. Eventually the contractor accepted one. Uber linked the attacker to the Lapsus$ group. Security researchers who spoke with the attacker reported that the final push came after a WhatsApp message posing as Uber IT, telling the contractor that accepting would end the prompts.
Earlier that year, Cisco suffered a similar intrusion. Cisco Talos reported that attackers took over an employee's personal Google account, where Chrome had synced the employee's saved Cisco credentials. The attackers then combined voice phishing, posing as trusted organizations, with a stream of push requests until the employee approved one. Once in, they enrolled new devices for MFA and connected to Cisco's VPN.
The technique has not faded. CISA's advisory on the Scattered Spider group, first published in November 2023 and revised in July 2025, lists push bombing alongside posing as help desk staff and SIM swapping. These attacks are aimed at the human, not the software, and they work against companies of every size.
Number matching: the fix Microsoft enforces, and its limits
Number matching changes the prompt. Instead of a simple Approve button, the sign in screen shows a short number and the user must type that number into the authenticator app. A user who did not start the sign in has no number to type, so a blind flood of prompts loses most of its power. CISA's October 2022 fact sheet called number matching one of the best interim mitigations for organizations that cannot yet adopt phishing resistant MFA.
Microsoft began enforcing number matching for all Microsoft Authenticator push notifications starting May 8, 2023, and its documentation confirms users cannot opt out. If your business uses Microsoft 365 with Authenticator, you already have it. If you use a different MFA product, check whether it offers number matching or a verified push option and whether it is actually switched on.
Number matching has two gaps. First, a live con still works: an attacker on the phone can read the number from their own screen and ask the victim to enter it. Second, some older connections never got number matching. Microsoft notes that its NPS extension, which many offices use to put MFA on VPN and Remote Desktop Gateway sign ins, does not support it, and unpatched AD FS servers keep showing plain Approve and Deny. Those back doors are worth checking.
Phishing resistant MFA removes the prompt entirely
The lasting fix is MFA that has no prompt to approve and no code to read aloud. FIDO2 security keys, passkeys, Windows Hello for Business, and certificate based sign in all prove identity with a cryptographic key tied to the real website, so a fake page or a persuasive caller has nothing to collect. CISA's Scattered Spider advisory states that phishing resistant MFA is not susceptible to push bombing or SIM swap attacks. We cover the options in detail in our guides to phishing resistant MFA and passkeys.
A sensible rollout starts with administrators, since Microsoft recommends phishing resistant MFA for privileged roles such as Global Administrator and Exchange Administrator. Finance staff, owners, and anyone who approves payments come next, then the rest of the team. Register two methods per person so a lost key does not become a lockout.
Microsoft 365 settings that blunt MFA fatigue today
Turn on Report suspicious activity in Microsoft Entra ID. When a user flags an unexpected prompt, Microsoft marks that user as high risk, which can trigger an automatic block if you have Entra ID P2 risk policies, or at least an alert your IT team can act on. The setting stays off unless an administrator enables it.
Stop over prompting. Microsoft's default sign in frequency is a rolling window of 90 days, and its guidance warns that constant reauthentication trains people to approve without thinking. Use Conditional Access to require a compliant, company managed device, so a stolen password plus one careless tap still fails from an attacker's laptop. Our list of Microsoft 365 security settings most businesses miss walks through these.
Watch the sign in logs. A cluster of denied MFA requests on one account is a loud signal that the password is already in someone else's hands, and 24/7 monitoring means that signal is seen at midnight, not on Monday. Finally, lock down your help desk process. Any request to reset MFA or register a new phone should require a callback to a number already on file and a second person's confirmation, because attackers increasingly call the help desk instead of the employee.
The one sentence every employee should know
If you get a sign in prompt you did not start, deny it, report it, and call IT, and remember that nobody from IT will ever ask you to approve a prompt or read you a code. An unexpected prompt also means your password is known, so it needs changing that day. Put that sentence in onboarding, repeat it in security awareness training, and post it where people work.
How GlobeVM helps stop MFA fatigue attacks
GlobeVM has supported businesses for 30 years and looks after more than 75 organizations across Southern California. Multifactor authentication, firewall management, endpoint protection, and email filtering are standard in every plan, and our 24/7 monitoring watches for the burst of denied prompts that signals an attack in progress. When something looks wrong, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi.
Our access control services cover number matching, phishing resistant MFA rollouts, Conditional Access, and help desk verification procedures. To see how your current sign in protection holds up, schedule a free IT assessment or call (818) 405-9930.
MFA fatigue questions we hear from business owners
What is an MFA fatigue attack?
It is an attack where someone who already has your password sends repeated MFA push requests to your phone, hoping you approve one by mistake, out of annoyance, or because a fake IT caller told you to. It is also called push bombing or MFA bombing.
Does number matching stop MFA fatigue completely?
No. It stops blind floods of prompts, because you have no number to enter for a sign in you did not start. It does not stop a live phone scam where the attacker reads you the number, and some older VPN and Remote Desktop connections may not use it. Phishing resistant MFA closes those gaps.
What should I do if I already approved a prompt by mistake?
Call IT immediately. The account password should be reset, all active sessions revoked, any newly registered MFA methods and inbox rules removed, and recent sign ins reviewed. Speed matters, because attackers often add their own MFA device within minutes.
Are text message codes safer than push notifications?
Not really. Text codes can be phished just like passwords, and attackers can hijack a phone number through SIM swapping. Both push with number matching and text codes are better than no MFA, but phishing resistant methods such as passkeys and security keys are the strongest option.
Is MFA fatigue a risk for small businesses or only big companies?
Small businesses face it too. Stolen passwords are sold in bulk, and the tools to trigger repeated prompts cost attackers almost nothing. A small office with one finance person who approves the wrong prompt can lose a wire payment just as easily as a large company.