IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
MFA fatigue — too many approval prompts
At 3:07 a.m. Priya's phone buzzes: "Approve sign-in?" She ignores it. It buzzes again, and again. By the fifth buzz she is awake, annoyed, and one sleepy tap from giving her account to a stranger. Your goal: explain this attack and the ladder of defenses.
- The attacker already has the password. Only the approval is missing.
- The attack is only volume: many prompts until a tired person taps Approve.
- Number matching removes the blind tap. Passkeys remove the prompt.
- Number matching does not stop a phishing page.
The attacker already has the password
An MFA fatigue attack starts only after someone has a valid password. It often comes from a breach dump, a leaked list of passwords (see Breached-password detection). Or it comes from a phish.
MFA should save Priya here. The attacker still needs her second factor. But suppose that factor is a plain push approval: a message that only says "Approve" or "Deny". Then the attacker has a new move that needs no malware.
Volume against a tired person
The attacker signs in again and again. Each try sends a push to Priya's phone. The bet is on the human: someone half asleep who wants the buzzing to stop. There is no clever trick here, only volume. Every defense below makes the quick tap impossible.
a stranger who rings your doorbell every minute at 3 a.m. You are not fooled. You are worn out, so you open the door to make it stop.
The defense ladder
You do not need one perfect fix. Each rung makes a blind tap harder.
| Rung | Control | What it does |
|---|---|---|
| 1 | Number matching | The sign-in screen shows a number. Priya must type it into the app. The number appears only on that screen, which the attacker sees, not Priya. So a blind tap has nothing to match (see Building a push authenticator). |
| 2 | Show context | Each prompt shows the app and the place of the sign-in. A sign-in "from another country" looks wrong. |
| 3 | Rate limit and lockout | After a few denials or too many prompts, new tries are blocked. The flood stops itself. |
| 4 | Adaptive risk | A known device in a normal place gets no extra prompts. The attacker's unknown device never reaches the push step (see Adaptive risk-based MFA). |
At 3 a.m. the phone buzzes again. This time it says: "Enter the number shown on your sign-in screen." Priya has no sign-in screen. She never started a login. There is nothing to type, so there is nothing to approve. She reports it and goes back to sleep.
The top rung: no prompt to approve
Passkeys remove the tap. There is no "Approve" button, because sign-in is a signature tied to the real site, not a yes-or-no message. No prompt means no fatigue attack.
Number matching is the practical floor. Passkeys are the ceiling. One warning: number matching stops a blind tap, but it does not stop a phishing proxy. If Priya is the one signing in on the fake page, she sees the number and types it. Only a passkey covers both attacks.
The attacker may add a human voice: "I am from IT. Approve the next prompt and the buzzing stops." The rule is simple. A prompt you did not start is never fixed by approving it. Deny it and report it.
Go deeper: What CISA says
CISA lists push bombing as a threat to push-based MFA. It ranks FIDO/WebAuthn above it.
Go deeper: A real case
In September 2022, Uber reported a break-in that began with a contractor's account. The attacker likely had the contractor's password. The attacker kept signing in, and each try sent a push request. Uber said the contractor accepted one, and the attacker got in. News reports at the time said the attacker also messaged the contractor and posed as IT. The lesson is the same as above: volume plus a believable voice. Source: Uber security update, 19 September 2022.
🧪 Interactive lab — enable JavaScript to play with this one.
The best cure is a login with no prompt to approve. Grade how phishing-resistant your setup is with Passkey Check.