Multi-factor authentication stops most account takeovers. That’s exactly why attackers found a way to turn it against the user. It’s called MFA fatigue, or push bombing, and it needs nothing more than a stolen password and patience.
What is an MFA fatigue attack?
An MFA fatigue attack is when an attacker who already has someone’s password triggers sign-in after sign-in, so the person’s phone fills with “Approve this sign-in?” prompts. Sooner or later, often late at night or in the middle of a busy morning, the person taps Approve just to make it stop. The attacker is in.
It’s also called MFA bombing, push spam or MFA push bombing. The idea is the same every time: wear the person down rather than break the technology.
How common is it?
- Microsoft recorded about 6,000 MFA fatigue attempts per day in the year to June 2023. (Microsoft Digital Defense Report 2023)
- MFA still blocks the vast majority of attacks: 97% of identity attacks are simple password attacks, and MFA stops over 99% of them. (Microsoft Digital Defense Report 2025) MFA fatigue is how attackers go after the small share it doesn’t stop.
- The best-known case is Uber in September 2022, where an attacker with a contractor’s password kept sending sign-in prompts until the contractor accepted one. (Uber security update, September 2022)
How the attack plays out
- The password leaks. It’s bought from an infostealer log, reused from another breach, or phished.
- The prompts start. The attacker signs in again and again. Each attempt sends a push to the person’s phone.
- Pressure is added. Many attackers message or call the person posing as the help desk: “We’re fixing your account, just approve the next prompt.”
- One tap. The person approves. The attacker now has a live session, and often adds their own MFA method so they can come back.
- The real goal. Mailbox rules that forward invoices, a payment-change email to a supplier, or access to files and other apps.
Signs an account is being push-bombed
- Many MFA prompts in a short time for one account, especially outside working hours.
- Several denied prompts followed by one approval. This is the single strongest sign.
- A sign-in from an unusual location or device right after the approval.
- A new MFA method or phone number added to the account soon after.
- New inbox rules, especially ones that forward mail outside the company or hide messages.
How to stop MFA fatigue
Make approving harder to do by accident:
- Turn on number matching, so the person has to type the number shown on the sign-in screen. Microsoft has enforced it in Microsoft Authenticator since May 2023, and CISA recommends it as a defence against push fatigue. (Microsoft; CISA)
- Show sign-in context (app name and location) in the prompt, so an unexpected request stands out.
- Move high-risk accounts to phishing-resistant methods such as passkeys or security keys where you can.
Limit what a stolen password can do:
- Block legacy sign-in methods that skip MFA altogether.
- Use conditional access to require a known device or block sign-ins from places your clients never work.
Teach one rule: if you didn’t just try to sign in, never approve a prompt, and report it. Real IT staff will never ask you to approve one.
Watch for it, and respond fast: prevention lowers the odds; detection limits the damage. Someone, or something, needs to notice the burst of prompts and act within minutes, not on Monday.
What to do if someone already approved
- End every active session for the account, not just the current one.
- Reset the password.
- Remove any MFA method the attacker added.
- Check and remove new inbox rules and app consents.
- Look for follow-on activity: emails sent from the account, files opened, payment requests.
How Centeye catches it
A related attack, AiTM phishing, skips the prompt flood entirely: the person approves a real sign-in on a fake page.
Centeye Gatewatch watches every sign-in across Microsoft 365 and Google Workspace. It spots floods of prompts sent to wear someone down, the approval that follows, and the stolen session that comes after. Then it ends the takeover within your rules: every session revoked, the password reset, and the attacker’s MFA method removed. Because Praxis joins identity with email and endpoint signals, a push-bombing attempt that leads to a forwarding rule or a fake invoice shows up as one case, not three alerts.
New to the terms? See the security glossary or read what ITDR is. Want to see it on your own tenants? Start a free trial.
Figures cited from the Microsoft Digital Defense Reports 2023 and 2025, Uber’s September 2022 security update, Microsoft’s Authenticator number-matching announcement, and CISA’s guidance on number matching in MFA apps.