MFA fatigue vs MFA bombing: what is the difference?

MFA fatigue and MFA bombing describe the same attack. Both mean flooding a user with authentication prompts until one is approved. Push bombing and MFA spamming are further names for it. There is no technical distinction worth drawing.

The terms differ only in emphasis. “Bombing” names the attacker’s action, the flood of requests. “Fatigue” names the human effect being exploited. Vendors have preferred different labels, which is why both persist.

What matters is that all the names require a prerequisite: the attacker already has a valid password. Prompts only arrive if the first factor succeeded.

Documented cases

• Uber combined the prompt flood with an IT-support impersonation to explain it away.
• 0ktapus shows the credential supply chain that makes the technique possible at scale.

The control that breaks it

• Number matching, which removes the one-tap approval the attack needs.
• Passkeys or hardware keys on privileged accounts.
• Treat a burst of denied prompts as a live incident, not noise.
• Reset the password too. Prompts mean it is already known.

Related: how to prevent MFA fatigue · MFA fatigue