Number Matching
Number matching is a push MFA design in which the sign-in screen shows a short number and the user must type that number into the authenticator app to approve, instead of tapping a plain Approve button. It stops blind approval of prompts the user did not start, which is the mechanism behind MFA fatigue and push bombing (MITRE ATT&CK T1621).
Microsoft documents that number matching is now enabled for all Microsoft Authenticator push notifications, including MFA, self-service password reset and the AD FS and NPS integrations, and it is not supported on wearable devices. The limit is important: number matching is still phishable. A real-time phishing proxy shows the victim the genuine number from the real sign-in page, and the victim types it in. NIST SP 800-63B-4 says authenticators that involve manual entry of an output "SHALL NOT be considered phishing-resistant", so number matching is an interim control on the way to passkeys or security keys. The 2022 Uber incident in the Identity Breach Database is the case usually cited for why plain push approval was not enough.
See also: MFA fatigue and push bombing, phishable MFA, phishing-resistant MFA, Microsoft Authenticator, MFA matrix
Related on Start with Identity
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossaryTwo-Factor Authentication (2FA)
Two-factor authentication (2FA) is sign-in that requires two distinct types of authentication factor, typically a password (something you know) plus a phone, co
- GlossaryVishing (Voice Phishing)
Vishing, short for voice phishing, is social engineering carried out over a phone call, in which an attacker impersonates a trusted party to get the target to r
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- ReportIdentity Breach Report 2026: how attackers get in
120 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 40 with a known MFA status, and 45.8% of 2025-2026 cases had no login for MFA to protect.