The MFA Fatigue is a technique of phishing and pressure where an opponent triggers many demands MFA to push the user to approve one. Number: reduces accidental validations, but any unexpected gust must also cause a compromised password to be suspected.
Simple definition
A technique that bombards a user of applications MFA to push him to accept one.
Technical definition
The attacker already has the password and triggers many notifications to the push until they get accidental or voluntary validation.
What is it used for ?
Understanding why a MFA Well configured push can be bypassed socially.
Practical example
A user receives many login requests until clicking Accept.
How to diagnose MFA Fatigue ?
If a user receives requests MFA Unsolicited, check the logbooks immediately: IP address, location, application, device and result of each attempt. Ask the user not to approve and consider that the password can already be known. Revise suspicious sessions and review the registered authentication methods before restoring access.
Common issues
Denying a notification does not resolve the incident alone if the attacker has the identifiers. Simple push notifications remain sensitive to human error and harassment. Number: improves resistance, while methods resistant to phishing as FIDO2/passkeys further reduces the possibility of approving the wrong session.
How to validate the correction — MFA Fatigue
After the incident, change the compromised secrets, revoke the chips and check that no method MFA unknown has not been added. Then strengthen the policy with identification, risk detection and authentication resistant to phishing For sensitive accounts. Train users to report a surge of requests rather than simply ignore them.
Related terms
MFA · Phishing · Conditional Access
Key takeaway: Exact behavior and commands may vary depending on versions, products and architectures.
FAQ — MFA Fatigue
Why can the attacker send requests MFA ?
Often because he already has the password and tries to cross the second factor.
Is Number Match enough?
It greatly reduces accidental validations, but does not replace risk detection or methods resistant to the phishing.
What to do after an unexpected request?
Do not approve, report the event, check the logs and treat the identifiers as potentially compromised.