To prevent MFA fatigue attacks, get rid of the one-tap approve prompt. Turn on number matching, move high-risk accounts to phishing-resistant MFA, and treat any denied prompt as a sign the password’s already been stolen.
MFA fatigue, also called push bombing, is what happens when an attacker who already has your password sends login prompts over and over until you approve one. CISA’s October 2022 fact sheet says users end up approving “by accident or out of annoyance.”
Key takeaways
Strongest first, weakest last. Most organizations need more than one.
| Control | How it stops the attack | Limit |
|---|---|---|
| Phishing-resistant MFA (FIDO2 security keys, passkeys) | There’s no push prompt to approve, and the login is tied to the real site | Rolling it out takes time, and replacement keys need strong identity checks |
| Number matching | The user has to type a number shown on the login screen, so a prompt they didn’t start can’t be approved | CISA calls it a stopgap, weaker than phishing-resistant MFA |
| Prompt limits and lockout | Puts a cap on how many prompts one account can trigger in a short time | Slows the attacker down, but one well-timed prompt can still get through |
| Alerting on denied prompts | A denied prompt means someone else has the password. CISA says to look into every one | Only works if users report and staff follow up |
| Help-desk reset verification | Stops the attacker switching to a reset request when the prompts don’t work | Has to cover contractors and outsourced desks too |
| One clear rule for staff | IT will never ask anyone to approve a prompt, by phone, chat or message | Training alone falls apart under pressure, so pair it with technical controls |
In SEE’s library, the prompt flood is just one way around MFA. These six cases cover the main ones.
| Case | How MFA was beaten | Control that targets that step |
|---|---|---|
| Uber, 2022 | Login approval requests sent to a contractor again and again until one was accepted. Press reports say the attacker also posed as tech support on WhatsApp | Number matching or phishing-resistant MFA, plus the “IT never asks” rule |
| Electronic Arts, 2021 | A stolen Slack session cookie bought for $10, then a message to IT support asking for a new MFA token, claiming to have lost a phone | Help-desk verification before reissuing tokens, and session revocation |
| MGM Resorts, 2023 | A call to the IT help desk, posing as an employee, to get MFA reset | Callback verification before any MFA reset |
| Clorox, 2023 | Calls to an outsourced service desk that reset passwords and MFA and changed the SMS-MFA phone number | Self-service resets and manager confirmation, with extra checks on phone-number changes |
| Microsoft and LAPSUS$, 2022 | Microsoft documented the group paying insiders to hand over credentials and approve MFA prompts | Phishing-resistant MFA tied to a device, and insider-risk monitoring |
| 0ktapus, 2022 | Fake Okta login pages collected about 9,931 credentials and 5,441 MFA codes | Phishing-resistant MFA, which won’t sign in to a fake site |
Number matching deals with the Uber step head-on. In the other five it barely helps, since nobody flooded anyone with prompts. That’s why the help desk has to be part of the plan.
It stops the flood. CISA’s fact sheet gives two reasons. You can’t approve without seeing the login screen, and every prompt has a new number, so spamming prompts gets the attacker nowhere.
CISA is just as clear that number matching is weaker than phishing-resistant MFA. If the attacker never sends a prompt at all, as in the Clorox and MGM help-desk resets, it does nothing.
When prompts stop working, attackers ask a person to reset the factor for them. It happens often enough to have its own attack family, help-desk and MFA manipulation.
At Electronic Arts, the attacker asked IT support for a new token. At Clorox, agents reset MFA and changed the phone number tied to SMS codes in the same run of calls. A reset should need the same proof of identity as signing up in the first place, like a callback to a number already on file.
It’s the same technique seen from two sides. MFA bombing, or push bombing, is what the attacker does: send a stream of login prompts. MFA fatigue is what it does to the user, who eventually approves one. Security guidance, CISA’s 2022 fact sheet included, uses the terms interchangeably. For the finer distinction, see MFA fatigue vs MFA bombing.
SMS codes skip the one-tap approve button, but they come with their own problems. A code can be read out to a caller pretending to be IT, and the phone number itself can be moved. At Clorox, a service-desk agent changed the phone number tied to an employee’s SMS codes. CISA strongly encourages every organization to move to phishing-resistant MFA instead.
Yes. The Uber breach started with a contractor’s account, and according to Uber the password was likely bought after malware got onto the contractor’s personal device. Contractors often sit outside the main identity program, on weaker devices with less training. Number matching, prompt alerts and reset checks should cover every account that can reach internal systems.
Look for several prompts or denials on one account within a few minutes, especially out of hours or from somewhere unfamiliar. CISA recommends investigating every denied push notification, because a prompt only shows up after the password has been entered. Back that alert up with a quick way for users to report prompts they didn’t expect.
Related: what MFA fatigue is and how it works · account takeover · credential harvesting vs phishing
Reviewed by SEE Team. Last reviewed 20 Oct 2026. See how answers are sourced and checked in the methodology, or who publishes this library.
Social Engineering Examples