# mfa-fatigue

Source: https://startwithidentity.com/glossary/mfa-fatigue/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the user accepts one, by accident or to make them stop. MITRE ATT&CK tracks it as [T1621, Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621/).

CISA's [October 2022 fact sheet](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf) recommends phishing-resistant MFA first and, where push has to stay, number matching as "one of the best interim" mitigations: the user must type a number shown on the sign-in screen into the app, so a prompt cannot be approved by someone who is not looking at that screen. Microsoft now [applies number matching to all Authenticator push notifications](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match) with no user opt-out, and [NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) no longer accepts out-of-band methods where the user compares two codes and taps approve, citing "authentication fatigue" attacks, and tells verifiers to limit the rate or number of push notifications. Number matching stops blind approval, not a phishing proxy that shows the victim the real number, which is why the end state is a [passkey](https://startwithidentity.com/glossary/passkey/) or security key with no prompt to approve. The 2022 Uber breach is the [best-known case](https://startwithidentity.com/breaches/mfa-fatigue-push-bombing/).

See also: [MFA fatigue and push bombing technique](https://startwithidentity.com/techniques/mfa-fatigue-push-bombing/), [MFA fatigue breaches](https://startwithidentity.com/breaches/mfa-fatigue-push-bombing/), [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), [MFA](https://startwithidentity.com/glossary/mfa/), [vishing](https://startwithidentity.com/glossary/vishing/)