Glossary
MFA fatigue (also called prompt bombing or MFA bombing) is an attack in which a criminal who already has a victim’s password repeatedly triggers push-notification approval requests, hoping the victim eventually approves one out of annoyance, confusion, or by mistake. It exploits the human weak point in push-based multi-factor authentication.
The attack presupposes the password is already compromised (through phishing, a breach, or credential stuffing) leaving only the MFA push between the attacker and the account. Prompt bombing is how they get past it without any technical exploit.
Holding valid credentials, the attacker initiates login again and again, generating a stream of push notifications to the victim’s device. The victim, bombarded with approval prompts (sometimes late at night, sometimes accompanied by a vishing call posing as IT "resolving the issue") may approve one to make the noise stop, or tap approve reflexively. A single approval grants the attacker access. This technique has featured in several high-profile corporate breaches.
Basic push MFA reduces authentication to a binary approve/deny, with little context and no proof that the person approving is actually the one logging in. That simplicity is convenient but exploitable: it relies on the user correctly judging, every time, whether a prompt is legitimate, and volume and fatigue erode that judgment. It’s a design that assumes good conditions and fails under deliberate pressure.
Several defenses blunt the attack. Number matching is the most effective: the user must enter a number displayed on the login screen into their app, which is impossible if they aren’t actually initiating the login. Rich context (showing location, app, and time) helps users spot illegitimate prompts. Rate limiting caps the flood. And risk-based logic can suppress or block prompts entirely when the pattern looks like an attack, rather than dutifully forwarding every one. The strongest answer, though, is phishing-resistant authentication (passkeys): with no approve/deny prompt to spam and a credential bound to the real site, prompt bombing simply has nothing to exploit.
MFA fatigue rose to prominence because it neatly solves the attacker’s post-password problem. Credentials leak constantly, so attackers frequently have a valid password but face an MFA push standing in the way. Rather than develop a technical exploit, they exploit the human, and it works often enough, against enough people, to be worthwhile. Its use in several widely reported corporate breaches cemented it as a standard part of the attacker playbook, frequently paired with a vishing call in which the attacker, posing as IT, "walks the victim through" approving the prompt to resolve the "glitch." That combination (technical spam plus human manipulation) is what makes it dangerous, and it’s a vivid illustration of why authentication that removes the approve/deny decision (passkeys) is fundamentally more robust than authentication that depends on a tired human making the right call at 2 a.m.
Why do attackers use MFA fatigue instead of a technical exploit?
They often already have the password and only need to get past the MFA push, so manipulating the human is easier than hacking the system.
What is MFA fatigue?
An attack that floods a victim with push approval requests until they approve one, exploiting push-based MFA.
What is prompt bombing?
Another name for MFA fatigue, repeatedly triggering MFA prompts to wear the victim down.
How do you stop MFA fatigue attacks?
Number matching, rich context, rate limiting, risk-based prompt suppression, and ultimately phishing-resistant methods like passkeys.
Why does MFA fatigue work?
Basic push reduces authentication to approve/deny, relying on the user to correctly judge every prompt, which volume and fatigue undermine.
Related: Multi-Factor Authentication (MFA) · Push Notification Authentication · Passkeys · Account Takeover (ATO) · Credential Stuffing
