Multi-factor authentication was supposed to be the thing that finally made stolen passwords a non-event. For the most part it has been. But attackers adapted, and one of the more effective workarounds doesn't touch the password or the second factor at all — it just wears the user down. MFA fatigue, also called push-bombing, has become a routine tactic in real intrusions over the past few years, and it works precisely because it exploits something MFA itself can't patch: human annoyance.
How the attack actually works
The setup is almost always the same. An attacker has already gotten hold of a valid username and password, usually from a previous breach dump, a phishing kit, or credential-stuffing against reused passwords. That's step one and it's the easy part — leaked credential databases number in the billions of records at this point, and password reuse across services remains extremely common.
Step two is where push-bombing comes in. The attacker enters the correct credentials over and over, each attempt triggering a legitimate push notification to the real user's authenticator app: "Approve sign-in?" One notification gets dismissed without much thought. A dozen of them, arriving at 11 p.m. or during a meeting, start to look less like an attack and more like a broken app that needs to be made to stop. Eventually, often out of simple irritation rather than any real belief the request is legitimate, someone taps approve just to make the notifications end. The attacker is in, using nothing more exotic than the account's own real second factor.
Why number matching changes the math
The standard push notification — a single "approve or deny" button — is what makes this attack easy in the first place, because it requires zero cognitive effort to approve incorrectly. Number matching closes a meaningful part of that gap. Instead of a yes/no tap, the login screen displays a two- or three-digit number that the user has to read and enter into the authenticator app to approve the request.
That extra step sounds small, but it changes the interaction from a reflexive tap into a deliberate action that requires looking at two screens and matching a number between them. A user who's being bombed with fake requests has to actively engage with each one rather than swiping it away, which tends to break the "just make it stop" reflex that push-bombing depends on. Most major identity providers — Microsoft Entra ID, Okta, Duo among them — have shipped number matching as a default or configurable option, and turning it on where it isn't already the default is one of the highest-leverage changes an IT admin can make in an afternoon.
Other layers worth stacking on top
Number matching helps but isn't a complete fix on its own, and a few other controls are worth pairing with it. Rate limiting or automatic lockout after a handful of failed or repeated MFA prompts in a short window stops the bombing pattern before it reaches the point of user fatigue at all — most identity platforms support configuring this threshold, and it's worth checking that it's actually set rather than left at a default that allows unlimited attempts.
Geographic and device context also matter. A push request originating from an unfamiliar country or an unrecognized device is a strong signal on its own, and platforms that surface that context directly inside the approval prompt — showing the requesting location and device alongside the number-matching screen — give users a second, independent reason to say no beyond just the number itself. Conditional access policies that require a known, managed device for sensitive systems reduce the blast radius even further, since a stolen credential and an approved push are worth a lot less to an attacker if the session still gets blocked by device posture checks downstream.
None of this replaces user education, but the messaging matters. Framing it as "if you get a push you didn't request, deny it and report it" is more actionable than a vague warning about phishing, and it gives employees a specific, low-friction thing to do when the fatigue attack actually shows up in their pocket.
Where this leaves a small IT team
None of these controls are exotic — number matching, prompt throttling, and context-aware access policies are available in the identity platforms most small and mid-size businesses already pay for. The gap is almost always configuration, not tooling: these settings exist but default off, or get set once during initial rollout and never revisited as the platforms add new options. For a business without dedicated security staff, working through a full identity platform's admin console to find and enable every relevant setting isn't a quick task, which is a large part of why teams like a managed IT services provider end up handling this kind of hardening as routine account maintenance rather than a special project.
Push-bombing isn't a sophisticated attack technique in the way a zero-day exploit is. It's closer to a social engineering trick that happens to route through a security control instead of around it. That's actually good news, because it means the fix is mostly a matter of tightening settings that already exist rather than deploying anything new.
Top comments (0)