MFA Fatigue Attacks: How to Secure Your Accounts

MFA fatigue attacks (also called push bombing or prompt bombing) bombard you with repeated multi-factor authentication (MFA) approval requests until you finally tap “Yes” out of annoyance or confusion. This guide shows you how to configure your accounts and devices to make these attacks nearly impossible to succeed, and what to do if you’re already being targeted.

What You’ll Need

• Access to the security settings of each online account you want to protect (email, banking, social media, work accounts, etc.)
• An authenticator app (like Google Authenticator, Microsoft Authenticator, or Authy) or a hardware security key (like YubiKey) — or the willingness to use phone-based SMS as a last resort
• Your phone or a secondary device to receive verification codes or approve sign-ins
• Administrator rights if you’re securing a company or organization’s accounts

Step-by-Step

1. Turn on MFA everywhere you can. Start with your email, banking, and social media accounts. If you haven’t enabled MFA yet, do that first — an attacker can’t send you push prompts if MFA isn’t active. Check each account’s security settings for “Two-Factor Authentication” or “Login Verification.”
2. Switch from push notifications to a hardware security key or authenticator app. Push-based MFA (where you tap “Approve” on your phone) is the most vulnerable to fatigue attacks. Instead, use a hardware key (like YubiKey) that requires you to physically insert it and touch it, or an authenticator app that generates a 6-digit code you must type in. Both require active participation — you can’t accidentally approve them.
3. If you must use push notifications, enable number matching. Many services (like Microsoft and Google) now offer “number matching” — the push notification shows a number, and you must enter that number on your device to approve the login. This prevents attackers from sending a generic “Approve?” prompt that you might tap without thinking. Look for this option in your account’s security or MFA settings.
4. Set a strong, unique password for each account. MFA is a second layer, but a weak password can still be cracked. Use a password manager to generate and store long, random passwords. Never reuse passwords across accounts.
5. Keep your recovery codes safe. When you enable MFA, you’ll be given backup codes. Store them in a secure place (like a password manager or a physical safe) — they’re your lifeline if you lose your phone or key. Never keep them in your email inbox.
6. For work accounts, require MFA for all employees and enforce number matching. If you’re an admin, set a policy that requires MFA for every user, and disable legacy authentication (like basic IMAP/POP) that bypasses MFA. Use conditional access policies to block sign-ins from unusual locations or devices.
7. Monitor your account for unusual activity. Most services let you see recent sign-ins and active sessions. Check this regularly. If you see a login you don’t recognize, sign out of all sessions and change your password immediately.
8. If you’re being attacked right now, do not approve any prompt. Instead, change your password immediately, sign out of all sessions, and contact the service’s support team. The attacker is likely trying to log in with your stolen password — changing it stops them.

Common Mistakes

• Approving a prompt “just to make it stop.” This is exactly what the attacker wants. Even if you’re busy, never approve an MFA request you didn’t initiate. Instead, click “Deny” or “It wasn’t me” if available, then change your password.
• Using SMS as your only MFA method. SMS is vulnerable to SIM-swapping attacks, where an attacker convinces your carrier to port your number to their SIM. Use an authenticator app or hardware key instead.
• Disabling MFA because it’s annoying. The inconvenience of typing a code is far less than the nightmare of a hacked account. Keep MFA on, but use a method that’s less disruptive (like a hardware key that you tap).
• Sharing your MFA codes or backup codes with anyone. Legitimate services will never ask for your codes. If someone does, it’s a scam.
• Not updating your recovery phone number or email. If you change your phone number and don’t update it, you could be locked out of your account — and an attacker who knows your old number might be able to use it.

Tips

• Use a dedicated authenticator app for each account. While some apps support multiple accounts, using separate apps (or at least separate folders) can help you quickly identify which account a prompt is for.
• For high-value accounts (like your main email or bank), use a hardware key. Hardware keys are phishing-resistant and cannot be tricked into approving a login you didn’t initiate.
• Set up a secondary email address for account recovery. Use a different provider than your main email, and enable MFA on that recovery email too.
• If you’re an admin, require MFA for all users and block legacy auth. Legacy protocols (like IMAP, POP, SMTP) don’t support MFA, so attackers use them to bypass your security.
• Consider using a passwordless approach. Some services (like Microsoft and Google) allow you to sign in with a security key or your phone’s biometrics instead of a password. This eliminates the password-cracking vector entirely.

Troubleshooting

• You’re getting flooded with MFA prompts. First, don’t approve any. Change your password immediately (use a different device or network if possible). Then sign out of all sessions. If the prompts continue, contact the service’s support and report the attack.
• You lost your phone or hardware key. Use your recovery codes to regain access. If you don’t have them, contact the service’s support — they may ask you to verify your identity with a government ID or other proof.
• Your authenticator app isn’t generating codes. Check that the time on your phone is correct (authenticator apps rely on time sync). If it’s off, go to your device’s settings and enable automatic time.
• You can’t log in because you don’t have your MFA device. Try using a different MFA method you set up (like a backup code or a secondary email). If you have none, you may need to go through account recovery — this can take days, so always keep recovery options updated.
• You think your account was already compromised. Change your password, sign out of all sessions, and check for any changes to your email forwarding, recovery phone, or security questions. Run a malware scan on your devices, and enable MFA again after securing the account.

Frequently Asked Questions

What exactly is an MFA fatigue attack?

An attacker who has your password triggers a flood of MFA approval requests on your phone. They hope you’ll accidentally tap “Approve” to make the notifications stop. Once you do, they’re in.

Can MFA fatigue attacks happen with any MFA method?

No. They only work with push-based MFA (where you tap “Approve”) or phone calls. Authenticator apps that require you to type a code, and hardware keys that require a physical touch, are immune because you have to actively generate or enter a code.

Should I turn off push notifications entirely?

Not necessarily. If your service supports number matching, that’s a good compromise — you still get the convenience of a push, but you have to verify a number. If not, consider switching to an authenticator app or hardware key for sensitive accounts.

What if I accidentally approved a prompt?

Act fast: change your password, sign out of all sessions, and revoke any recent MFA registrations. Then check your account for any changes (like new recovery email or forwarding rules). If you’re locked out, contact support immediately.

Is SMS-based MFA better than nothing?

Yes, it’s better than no MFA, but it’s the least secure method. SIM-swapping attacks can intercept your codes. Use an authenticator app or hardware key whenever possible.

How do I know if my accounts support number matching?

Check the security settings of each service. Microsoft, Google, and many others have enabled number matching by default or offer it as an option. If you don’t see it, contact the service’s support or check their help documentation.

Related

• Natural Gas Heating Value Calculator and Formula
• Insulin Units to mL Calculator and Conversion Guide
• Impedance in Parallel Circuits: How to Calculate It