It is 1:47 in the morning and your office manager’s phone buzzes. A login approval request. She taps Deny and rolls over. It buzzes again. Deny. Again. By the fifteenth buzz she is barely awake and just wants the noise to stop, so she taps Approve. Somewhere far away, an attacker who already had her password walks straight into your Microsoft 365 account.
That is the entire attack. No malware, no code, nothing that looks like hacking in the movies. It is called MFA fatigue, or push bombing, and it has been used to breach some of the largest companies in the world. Before we go further, one important point: multi-factor authentication still matters, and turning it on remains one of the best security moves a small business can make. But it is a seatbelt, not a force field, and attackers have learned exactly where the buckle sits.
What Push Bombing Actually Is
Start with what MFA does. A password is something you know. MFA adds something you have, usually your phone, so a stolen password alone is not enough to get in. The most convenient version is the push notification: a login attempt triggers an Approve or Deny prompt on your phone, and you tap once.
Push bombing abuses that convenience. CISA, the federal cybersecurity agency, describes it plainly: attackers bombard a user with push notifications until they press Accept. The attacker already has the password, usually bought from a data leak or captured by a fake login page. The prompts are real. The login attempt is real. The only fake thing is the person behind it.
Some victims approve just to make the buzzing stop. Some assume the system is glitching and approve to reset it. And in the polished version of the attack, a call or text arrives at the same time from someone posing as the IT help desk: “We’re pushing an update tonight, just approve the prompt and you’re all set.” That pairing is how the widely reported 2022 Uber breach unfolded: a contractor’s purchased password, a flood of MFA prompts, and a friendly message claiming to be from IT.
Why This Works on Good Employees
It is tempting to file this under carelessness. Resist that. Push prompts have trained all of us to tap Approve dozens of times a month without reading anything. Attackers time their floods for late nights, commutes, and busy Monday mornings, when attention is thinnest. The prompt looks identical to the real thing because it is the real thing.
A tired person making a reasonable-seeming choice at 2 a.m. is not a character flaw. It is a design flaw. So the fix belongs in the design, not in another lecture to your team. Two upgrades do most of the work.
Fix One: Number Matching
Number matching turns the Approve button into a small test. Instead of tapping a button, the sign-in screen shows a two-digit number, and the user must type that number into the authenticator app to finish logging in. If your phone asks for a number and you are not looking at a login screen, you have nothing to type, and there is nothing to blindly approve.
That one change kills the classic push bomb, because the number appears on the attacker’s screen, not the victim’s. Microsoft believes in it strongly enough that number matching is now enabled for all Microsoft Authenticator push notifications, and users cannot opt out. If your team signs into Microsoft 365 with the Authenticator app, you likely have this protection already. If you use a different MFA product, check whether number matching is turned on, because on some platforms it is still an optional setting that ships disabled.
Fix Two: Phishing-Resistant MFA and Passkeys
Number matching stops the blind tap. It does not stop a persuasive phone call, because a smooth talker can walk a victim through typing the number. For the accounts that matter most, CISA calls phishing-resistant MFA the gold standard, and the term is worth translating.
Phishing-resistant MFA, built on standards called FIDO and WebAuthn, ties your login to a digital key stored on a physical device: a small USB security key, or the secure chip already inside your phone or laptop. Passkeys are the consumer-friendly version of the same idea. The key only answers to the genuine website, so a fake login page gets nothing, there is no prompt to approve, and there is no code to read to a caller. CISA ranks the options roughly like this, strongest first:
- Phishing-resistant MFA: passkeys, hardware security keys, and smart cards. Nothing to approve, nothing to recite, nothing to steal with a fake page.
- App-based MFA with number matching: strong against push bombing, still beatable by a talkative attacker on the phone.
- One-time codes from an app or token: solid, but a convincing fake login page can capture and replay them.
- Plain push notifications: vulnerable to push bombing, by CISA’s own assessment.
- Text message or voice call codes: better than a password alone, and treated by CISA as a last resort.
What to Change This Quarter
None of this requires ripping out what you have. It is a short, ordered list of adjustments:
- Turn on number matching everywhere it exists. Microsoft enforces it. Other platforms may be waiting for you to flip the switch.
- Limit the flood. Many identity platforms can lock an account after repeated denied prompts. Ask your IT provider to set that threshold so a bombing attempt shuts itself down.
- Teach one sentence. If you get a prompt you did not cause, tap Deny and tell IT. Make it clear nobody will ever be in trouble for denying, even if it turns out to be a real login.
- Move your VIPs first. Owners, administrators, and anyone who touches money should get passkeys or hardware keys before the rest of the company.
- Assume the phone call is coming. Attackers increasingly pair prompt floods with convincing voices, some of them AI-generated. We covered that shift in how AI-powered attacks are getting smarter.
The Bottom Line
MFA fatigue is not proof that MFA failed. It is proof that attackers respect it enough to engineer a way around it. Keep MFA on everything. Upgrade the push prompt to number matching today, because it is likely free and possibly already on. Then start moving your most sensitive accounts to passkeys or security keys. Each step costs little, and together they remove an entire category of 2 a.m. mistakes from your risk list.
Not sure which flavor of MFA your business is actually running? That is a five-minute conversation with Harrison Ward Technology, and we will tell you plainly what to keep and what to upgrade. Contact us today
Sources:
Comments are closed