👋 Welcome to Digital Identity!

🛡️ Why MFA Fatigue Attacks Are on the Rise — And How to Stop Them

👀 What Is an MFA Fatigue Attack?

Multi-Factor Authentication (MFA) is one of the most effective security controls out there  but like anything, it’s not bulletproof.

MFA fatigue attacks (also known as MFA spamming or push bombing) are when an attacker floods a user's phone or device with MFA approval requests, hoping the victim eventually clicks “Approve” out of annoyance or confusion.

🎯 Goal: Trick a user into authorizing a malicious login attempt.

🔥 Why Are MFA Fatigue Attacks Increasing?

Several factors are driving this trend:

Stolen Credentials Are Common

Breaches, phishing, and dark web leaks have made usernames/passwords easy to obtain.

Push-Based MFA Is Widely Used

Tools like Microsoft Authenticator, Duo, and Okta use push notifications that are easy to spam.

Humans Get Tired

If you're getting 10+ login requests at 2AM, you're likely to just hit “approve” to make it stop.

No Extra Verification

Many MFA systems don’t require verifying where or why the request came from  just a button press.

⚠️ Real-World Example: Uber (2022)

In 2022, Uber was breached by a hacker who used MFA fatigue against an employee. After dozens of login requests, the attacker messaged the employee on WhatsApp pretending to be IT support. The employee eventually accepted one of the requests  giving the attacker access.

🛑 How to Stop MFA Fatigue Attacks

✅ Here's what users, IT admins, and organizations can do to prevent MFA fatigue:

🧑‍💻 For End Users

Never approve a login you didn’t initiate

Report unexpected MFA prompts to your IT/security team

Enable number matching (if available)  some apps show a code you must match

Don’t reuse passwords across accounts  use a password manager

🏢 For Organizations / Admins

Implement Number Matching or PIN Verification

Microsoft, Duo, and Okta support this

Use FIDO2 Security Keys

Hardware-based MFA like YubiKeys is phishing-resistant

Limit MFA attempts per time window

Use conditional access or rate limiting

Educate Employees

Train staff to recognize suspicious behavior

Enable Geo and Device Context Alerts

Block or flag logins from new locations/devices

🔐 Better MFA Practices = Better Security

While MFA fatigue attacks are clever, they rely on human error and weak defaults. With the right policies and user awareness, your organization can stay resilient.

Remember: Security is not just about tools — it’s about how we use them.