# number-matching

Source: https://startwithidentity.com/glossary/number-matching/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Number matching is a push MFA design in which the sign-in screen shows a short number and the user must type that number into the authenticator app to approve, instead of tapping a plain Approve button. It stops blind approval of prompts the user did not start, which is the mechanism behind [MFA fatigue](https://startwithidentity.com/glossary/mfa-fatigue/) and push bombing ([MITRE ATT&CK T1621](https://attack.mitre.org/techniques/T1621/)).

Microsoft documents that number matching is now [enabled for all Microsoft Authenticator push notifications](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match), including MFA, self-service password reset and the AD FS and NPS integrations, and it is not supported on wearable devices. The limit is important: number matching is still phishable. A real-time phishing proxy shows the victim the genuine number from the real sign-in page, and the victim types it in. [NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) says authenticators that involve manual entry of an output "SHALL NOT be considered phishing-resistant", so number matching is an interim control on the way to [passkeys](https://startwithidentity.com/glossary/passkey/) or security keys. The 2022 Uber incident in the [Identity Breach Database](https://startwithidentity.com/breaches/incidents/2022-uber-mfa-fatigue/) is the case usually cited for why plain push approval was not enough.

See also: [MFA fatigue and push bombing](https://startwithidentity.com/techniques/mfa-fatigue-push-bombing/), [phishable MFA](https://startwithidentity.com/glossary/phishable-mfa/), [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), [Microsoft Authenticator](https://startwithidentity.com/vendors/mfa/microsoft-authenticator/), [MFA matrix](https://startwithidentity.com/tools/mfa-matrix/)