MFA fatigue attacks are stopped by removing the simple approve button. Number matching, or a move to phishing-resistant methods such as passkeys and hardware keys, means an endless stream of prompts gives the attacker nothing to gain from persistence.
The attack depends on volume plus a plausible explanation. Push prompts arrive until the target approves one out of confusion or exhaustion, and a follow-up call posing as IT supplies the reason to do it.
Documented cases
- Uber is the definitive case: an attacker bought a contractor’s password, flooded them with push prompts, then posed as Uber IT to get one approved.
- 0ktapus collected 5,441 MFA codes, showing that second factors are themselves a target.
- EA Games bypassed MFA entirely by using a stolen session token.
The control that breaks it
- Turn on number matching so approval requires reading a code from the login screen.
- Move high-value accounts to passkeys or hardware keys.
- Rate-limit push prompts and alert on repeated denials, the clearest signal of an attack underway.
- Tell staff that IT will never call to ask them to approve a prompt. That single rule broke the Uber chain.
Related: MFA fatigue vs MFA bombing · credential harvesting vs phishing · MFA fatigue
Related
Social Engineering Examples