What an MFA fatigue attack is
Multi-factor authentication stops a stolen password from being enough on its own. So attackers who already have someone's password try another route: they trigger sign-in after sign-in, sending a stream of approval requests to the person's phone. Some send them in the middle of the night or during a busy morning, hoping the person will eventually tap 'approve' just to make the notifications stop, or by mistake. Sometimes the prompts are followed by a phone call or text from someone claiming to be IT support, saying they're fixing a problem and you need to approve the next request. That combination of annoyance and a helpful-sounding voice has worked against large, well-resourced organisations, not just small ones.
What to do the moment it happens
Deny every prompt you didn't start. If your authenticator offers a 'report' or 'this wasn't me' option, use it, because that can alert your IT administrator and sometimes block further attempts automatically. Don't approve a prompt to see what happens or to test it. Then treat your password as stolen. From a trusted device, change your password for that account and anywhere else you've used it. Tell your IT contact immediately so they can check sign-in logs, see where the attempts came from and confirm nobody got in. If you approved one by accident, say so straight away; that's an urgent situation, but a quick report keeps it manageable.
Why the attacker had your password
Prompt bombing only works if the attacker already knows your password, so it's worth working out how. Common reasons include reusing a password that leaked from another website, typing it into a phishing page at some point, malware on a home computer that captured it, or a password that was simply too easy to guess. Check whether your email address appears in known breaches using a reputable breach-notification service, and look at whether you've reused that password anywhere. Moving to a password manager with unique passwords removes the most common cause and makes the next attack far less likely.
Settings that stop prompt bombing
Number matching is the most important fix. Instead of a simple approve button, the sign-in screen shows a number that must be typed into the authenticator app. An attacker can trigger the prompt but you won't see the number, so you can't approve it by accident. Microsoft Authenticator uses number matching for Microsoft 365 push sign-ins; check other services you use. Showing extra context also helps: the app can display the location and application requesting sign-in, so 'Moscow, unknown app' at 2am is obviously not you. Administrators can limit how many requests are allowed in a short period and lock the account temporarily after repeated denials.
Other ways attackers get around MFA
Prompt bombing isn't the only trick. In a SIM swap, a criminal persuades a mobile carrier to move your number to their SIM, then receives your text message codes. In relay phishing, a fake website passes your password and code to the real service in real time and keeps the session that comes back. Help desk scams involve someone ringing your IT provider, pretending to be you, and asking for MFA to be reset.
Each has a defence. Avoid text codes for important accounts, use passkeys or security keys that won't work on fake sites, and make sure your IT provider verifies identity properly before resetting anyone's sign-in, ideally with a call back to a known number or a video check. None of these needs any special skill on the attacker's part, just a stolen password and patience.
Teach staff one simple rule
Every staff member should know this rule by heart: never approve a sign-in request you didn't start yourself, a second ago, on your own device. It doesn't matter who calls, what they say, or how many prompts appear. Genuine IT support will never need you to approve a sign-in you didn't begin. Make reporting unexpected prompts as easy as possible. A quick message saying 'I'm getting MFA requests I didn't ask for' is one of the most valuable early warnings a business can receive. It means someone already has a valid password, and you've found out before they got in.
Checking nothing slipped through
After an MFA fatigue attempt, whoever looks after your IT should review the account's recent sign-ins, registered MFA methods, inbox rules and forwarding settings, and connected apps. Attackers who succeed often add their own MFA method so they can return later, or create a rule hiding replies from the real user.
If everything looks clean and the password has been changed, the attack has failed. Use it as a prompt to review the rest of the team: are number matching and sign-in context switched on for everyone, do admins have phishing-resistant methods, and are text codes still allowed where they shouldn't be?
In short
- An unexpected MFA prompt means someone probably has your password.
- Deny it, report it, change the password and tell IT.
- Number matching stops accidental approvals.
- Never approve a prompt because someone on the phone asks you to.
- Review MFA methods and inbox rules after any attempt.