MFA fatigue is what happens when attackers stop trying to defeat your second factor and start trying to exhaust the human holding it. It is cheap, it scales, and it has opened doors at companies with security budgets a thousand times yours.
The mechanics
Step one: obtain a valid password, from a credential dump, a phishing page, or an infostealer. Step two: attempt logins on a loop, each one firing a push notification to the owner’s phone. Ten at dinner. Five more at 11 p.m. Three at 2 a.m. The target is not the cryptography; the target is annoyance. Eventually a tired thumb taps approve to make the phone shut up, and the attacker is inside with a fully legitimate session.
Why blind-approve prompts are the weakness
A push that asks only approve or deny carries no context and demands no thought. The fix is number matching: the login screen shows a two-digit code, and the phone requires you to type it. An attacker’s prompt shows a number you cannot see, so a sleepy approval is structurally impossible. Microsoft, Google, Okta, and Duo all support this today; in most tenants it is a checkbox you have simply not checked yet.
The settings that matter
Enable number matching everywhere it exists. Add rate limiting so five denied prompts locks the account and pages someone, because a burst of denials at 2 a.m. is not noise, it is the clearest indicator of compromise you will ever get for free. Show geographic context in prompts where supported. And for admin and finance accounts, skip push entirely and issue hardware keys or passkeys, which remove the approval decision altogether.
Train the one sentence
An MFA prompt you did not ask for means someone has your password. Not might mean. Means. Report it immediately and we will reset credentials with a thank-you, because that report just told us exactly which account is compromised before it cost anything. That single sentence, believed, defuses the entire attack class.
Shutting down MFA fatigue this week
MFA fatigue is one of the few attack classes you can structurally eliminate in an afternoon: number matching on, rate limits on, hardware keys for the accounts that matter. CISA’s MFA guidance covers the fundamentals; our Defend practice handles the tenant settings, the training sentence, and the alert that fires when someone’s phone starts buzzing at 2 a.m.
If your MFA still asks for a blind approve, that checkbox is the cheapest security win you have left.
