MFA fatigue: how attackers flood notifications and how to defend against it

Understanding MFA fatigue

MFA fatigue, also called MFA fatigue, is a social‑engineering technique where the attacker overwhelms the target with multiple authentication requests, exploiting the tendency to approve quickly to avoid disruption. In practice, the attacker triggers several simultaneous login attempts, creating an avalanche of push notifications on the smartphone or authenticator app. Under the pressure of volume, the user may approve a request without verifying its source, opening a gateway to the account. This method requires no technical flaw, only manipulation of the human factor, making it especially effective against overloaded security teams or users poorly trained on multi‑factor authentication risks.

Typical attack scenarios

Attackers often use automated scripts to launch login attempts from various entry points, each attempt generating an MFA notification. By targeting high‑privilege accounts, they increase the value of a compromise. A common scenario involves prior phishing to obtain the user’s identifier, followed by a wave of MFA requests aimed at exhausting the victim’s vigilance. Other variants exploit cloud services or VPNs where MFA is mandatory, multiplying alerts until the user defaults to approving. These attacks are hard to detect because each request appears legitimate from the authentication system’s perspective.

Effective defense mechanisms

To counter MFA fatigue, it is recommended to enable number matching, which requires the user to enter a code displayed on the login screen into the authenticator app, making remote approval harder. Using FIDO2 security keys, based on the WebAuthn standard, removes reliance on push notifications by requiring physical authentication via a USB, NFC, or Bluetooth device. Additionally, implementing rate limits on authentication attempts and applying behavioral analysis to MFA traffic can spot abnormal patterns. EBH Security advises combining these technical controls with ongoing user awareness training to reduce human error risk.

Organizational best practices

At the organizational level, it is essential to define clear policies for handling MFA notifications, including procedures to verify the source before any approval. Limiting the number of accounts with privileged access and applying the principle of least privilege reduces the impact of a potential breach. Regularly rotating authentication devices and disabling legacy MFA methods (SMS, phone calls) strengthens the security posture. Finally, incorporating MFA fatigue simulation exercises into training programs helps teams recognize and respond to this type of attack.

FAQ