What Is MFA Fatigue? How Push-Bombing Attacks Work in 2026

Your phone buzzes at 2am. Then again. And again. A dozen login approval prompts arrive one after another, each asking you to tap Approve for a sign-in you never started. This is MFA fatigue, also known as push bombing, and it is one of the simplest ways attackers break into accounts protected by multi-factor authentication. Instead of cracking your security, the attacker just wears you down until you tap Approve to make the noise stop. Here is how the attack works, why it still succeeds in 2026, and the specific defences that shut it down.

MFA fatigue, or push bombing, is an attack where a criminal who already has your password floods your phone with multi-factor authentication approval requests, hoping you will eventually tap Approve by mistake, out of annoyance, or because a fake IT support message tells you to. It works against simple push approvals but fails against number matching, hardware security keys and passkeys.

How a push-bombing attack actually works

The attacker starts with your password. They may have phished it, bought it from a breach dump, or talked it out of someone using what is social engineering tactics. With the password in hand, they sign in to your account, which triggers a push notification to your authenticator app.

Then the flood begins. The attacker’s script attempts to sign in again and again, sometimes dozens of times in a few minutes. Every attempt sends another Approve or Deny prompt to your phone. Late at night, half asleep, many people eventually tap Approve just to silence the buzzing, or they tap it by muscle memory while clearing notifications.

The attack in five steps

1. Steal the password. Phishing kits, credential-stuffing lists and infostealer malware supply the first factor.
2. Trigger the push. The attacker signs in repeatedly, generating a stream of approval prompts on the victim’s phone.
3. Bombard the victim. Dozens of prompts arrive over minutes or hours, often late at night when judgement is at its worst.
4. Add pressure. Many attacks pair the flood with a fake IT support message telling the victim to approve the prompt to stop a supposed security incident. In the 2022 Uber breach, the attacker messaged a contractor on WhatsApp while posing as IT staff.
5. One tap is enough. A single accidental approval grants access. The attacker then registers their own device or changes recovery settings so they can return quietly.

Why MFA fatigue keeps working in 2026

Push bombing exploits a human weakness, not a software bug. Notification overload is real: the average smartphone user receives dozens of alerts a day, and approving a prompt has become a reflex action. Attackers time their floods for nights and weekends, when the victim is tired, distracted, or the on-call person most likely to approve something quickly.

It also works because simple push approvals ask for almost no thought. Tapping Approve takes a fraction of a second and looks identical whether the login is yours or an attacker’s. Microsoft recognised this problem and made number matching the default for Authenticator push notifications in 2024, forcing users to type a two-digit number shown on the login screen. Organisations that never switched, and consumer apps that still use plain approve or deny prompts, remain exposed. In 2025, according to Microsoft, the company also began removing stored passwords from Authenticator to nudge users toward passkeys.

Real attacks that used push bombing

In 2022, Microsoft’s threat researchers documented the LAPSUS$ group using MFA bombing alongside SIM swapping and helpdesk social engineering in campaigns against major technology companies. The group treated push fatigue as a standard step in its playbook, not a clever trick.

The most famous case came in September 2022, when an attacker breached Uber by bombarding a contractor with MFA prompts and then messaging them on WhatsApp while posing as IT support. The contractor approved one prompt, and the attacker reached Uber’s internal systems, including Slack and cloud consoles. Uber disclosed the incident publicly, and it became the textbook example of the technique.

Since then, CISA has repeatedly urged organisations to move to phishing-resistant MFA, naming FIDO2 security keys and passkeys as the gold standard. Push bombing has not gone away: it remains the go-to technique against any account still protected by simple approve or deny prompts.

Which defences actually stop push bombing

Not all MFA is equal. Here is how the common methods hold up against a push flood:

The pattern is clear: anything that asks the user to confirm which login they are approving defeats the attack. If you take one step this week, turn on number matching in your authenticator app. Microsoft’s documentation on number matching walks through the setting for administrators.

How to protect yourself and your organisation

1. Enable number matching. In Microsoft Authenticator it is now the default for new tenants; in Duo, enable Verified Duo Push. This single change kills basic push bombing.
2. Move to phishing-resistant MFA. FIDO2 keys such as the YubiKey 5 series, or passkeys stored on your phone, cannot be approved by an attacker’s login attempt at all. Our guide to passkeys vs passwords covers migration trade-offs.
3. Limit the flood. Admins should cap the number of prompts per user per hour, block impossible-travel sign-ins, and alert on repeated MFA denials. Ten denied prompts in five minutes is an attack, not a confused user.
4. Train the reflex. The rule is simple: never approve a prompt you did not just trigger yourself. Report unexpected prompts to IT immediately instead of tapping Deny and forgetting about them.
5. Pick a solid authenticator. If you are still choosing an app, our roundup of the best 2FA apps covers which ones support number matching and passkeys in 2026.

You approved a prompt you did not trigger. What now?

Do not panic, but act fast. An approved prompt means the attacker may already be inside the account.

1. Change the password from a clean device, using a password manager to generate something unique.
2. Revoke active sessions in the account’s security settings, which signs the attacker out everywhere.
3. Check for new MFA methods the attacker may have added, and remove anything you do not recognise.
4. Alert your IT or security team if it is a work account; they can check logs for what the attacker touched.
5. Watch for follow-up phishing over the next few weeks, since the attacker now knows your details.

Frequently Asked Questions

What is MFA fatigue in simple terms?

MFA fatigue is when an attacker who has your password floods your phone with login approval requests, hoping you will tap Approve by mistake, out of annoyance, or because a fake IT message told you to. It is also called push bombing, and it targets the person rather than the technology.

Can attackers really bypass MFA with push bombing?

Yes, against simple approve or deny push prompts. The attack does not break the cryptography; it tricks the human. One accidental approval is enough for full access. That is why security teams now treat plain push approvals as weak MFA and recommend number matching or phishing-resistant methods instead.

Does number matching stop MFA fatigue attacks?

Yes. With number matching, the prompt shows a two-digit number from the login screen that you must type in. An attacker’s login shows a different number than yours, so you cannot accidentally approve their session. Microsoft made this the default in Authenticator in 2024.

Are passkeys immune to push bombing?

Yes. Passkeys are bound to the legitimate site and your device, so there is no approval prompt an attacker can trigger. Even if they have your password, their fake login cannot produce a valid passkey signature. This is why CISA calls passkeys and FIDO2 keys phishing-resistant.

What should I do if I get MFA prompts I did not request?

Do not approve them. Tap Deny, then change your password from a trusted device and revoke active sessions. Report the prompts to your IT team if it is a work account. Repeated unexpected prompts usually mean someone has your password and is actively trying to get in.

Conclusion

MFA fatigue succeeds because it attacks the person, not the protocol, turning a security feature into a source of annoyance that people eventually dismiss with a tap. The fix is straightforward: number matching for push approvals today, and passkeys or hardware keys wherever you can adopt them. If you remember one rule, make it this: never approve a login prompt you did not trigger yourself, and treat unexpected prompts as an attack in progress. Report them, change your password, and move to phishing-resistant MFA before an attacker tests your patience at 3am.