What is MFA fatigue?
MFA fatigue, also called push bombing or push harassment, is a way to get past multifactor authentication without defeating its cryptography. When MFA sends an approve-or-deny push notification to a phone, an attacker who already has the user's password triggers login after login, flooding the victim with prompts. The attacker is counting on the victim approving one to make the noise stop, or tapping approve by reflex while distracted.
How it works
The attacker first needs a valid password, usually from phishing, a breach dump or password spraying. They then submit login attempts repeatedly, each of which fires a new push to the real user's device, sometimes at night to catch them half-asleep. One approval completes the attacker's login. This technique was a factor in several high-profile 2022 breaches, including an incident at Uber.
How it looks
From the user's side, it is a burst of unexpected authentication prompts for an app they are not actively signing in to. From the logs, it is many MFA challenges for one account in a short window, from a source the user does not recognize, ending in a single approval and a successful login from an unfamiliar device or location.
How to defend against it
Number matching is the targeted fix: instead of a plain approve-or-deny, the login screen shows a short number, often two digits, that the user must type into the prompt on their phone. A user being bombed has no number to enter, so reflexive approval no longer works. Rate limiting the number of prompts, alerting on repeated denials, and user training to deny and report unexpected prompts all help. The strongest answer is phishing-resistant MFA such as FIDO2 security keys and passkeys, which have no push to approve at all.
MFA fatigue vs. other MFA bypasses
MFA fatigue exploits the user tapping approve. An adversary-in-the-middle proxy instead relays a real login and steals the session cookie, and SIM swapping redirects SMS codes to the attacker. Number matching stops push bombing specifically; it does not stop a proxy that captures the post-login session. Match the defense to the technique the scenario describes.
MFA fatigue on the CompTIA Security+ exam
MFA fatigue is an indicator of malicious activity under objective 2.5. A scenario where a user receives repeated push notifications they did not request, then an account is compromised, points at it, and number matching is the targeted control. The distractors are SIM swapping, one-time-code phishing and an adversary-in-the-middle proxy. When a question asks for MFA that resists these bypasses in general, the answer shifts to phishing-resistant FIDO2 or passkeys.