Push fatigue (MFA fatigue)

Push fatigue is an attack that bombards a user with authentication approval prompts until one is tapped, by accident, in annoyance, or on the assumption the system is glitching. It works because push MFA outsources the security decision to a human interrupt, and humans under interruption say yes.

The defence is to make approval carry information the user must match rather than a single tap: number matching, the requesting application, the location. Each turns the prompt from a yes-or-no interrupt into a comparison, which is much harder to pass by reflex.

Rate limiting the prompts themselves is the other half, since the attack depends on volume.

The attack requires valid credentials, which is what makes it a second-stage technique rather than an entry point. An attacker with a password from a breach corpus can trigger prompts at will, so the presence of fatigue attempts is a signal that the first factor has already fallen, and it is worth alerting on for that reason alone rather than only defending against.

Number matching works because it changes the cognitive task. A yes-or-no interrupt can be answered by reflex; a prompt that requires reading a number from one screen and entering it on another cannot be completed without attending to it, and an attacker who cannot see the challenge screen cannot supply the number. The same logic is why showing the requesting application and location helps: each is a fact the user can find wrong.

The structural answer is to stop relying on a human interrupt as the security decision. An origin-bound passkey has no approval step to spam, which is why migration is the durable fix and rate limiting is the control that buys time for it.

Until that migration is done, capping prompts per account per interval and alerting on the cap is the control that costs nothing and buys the most.

A flood of prompts against one account is also evidence that a password has already leaked, which is where credential stuffing usually supplied it.