You’ve got MFA set up. Good. That used to be enough to feel reasonably secure. The problem is that attackers have adapted, and one of the simplest adaptations, MFA fatigue, is working surprisingly well against small businesses that haven’t updated how they think about authentication.

Here’s the thing about MFA fatigue: it doesn’t require any sophisticated technical exploit. An attacker gets hold of your username and password (through a phishing attack, a data breach, or buying credentials on a forum) and then uses an automated tool to send you a continuous stream of MFA push notifications. Dozens of them, at 3am. The theory: at some point you’ll accidentally accept one, or accept one just to make it stop, or accept one because you’ve got a new phone and assume the previous notification was a sync artefact.

It sounds too simple to work. It works.

Who’s Being Targeted

The NCSC’s 2026 cyber threat report notes a significant increase in push notification bombing attacks against UK SMEs, particularly targeting Microsoft 365 and Google Workspace accounts. These are the accounts that hold everything: emails, documents, financial records, customer data. Compromising one gets an attacker into the whole organisation.

Small businesses are attractive targets for this type of attack because the credential theft is often automated (your username and password are in a breach database), the push-notification bombardment is automated, and the human factors that make it effective (distraction, unfamiliarity with the attack, assumption that repeated notifications are a technical error) are harder to mitigate in an organisation without dedicated security staff.

The specific scenarios where MFA fatigue works best: targeting senior figures in the business (directors, finance managers) who are less likely to have had recent security training, and targeting people during high-pressure periods (end of financial year, busy trading periods) when they’re more likely to click accept to clear a notification.

Why Your Existing MFA May Not Be Enough

Traditional TOTP MFA (where you type in a 6-digit code from an authenticator app) is more resistant to fatigue attacks than push notifications, because a fatigue attack sends push notifications that the user must actively approve. It can’t replicate a 6-digit code.

But push notification MFA (Microsoft Authenticator, Google’s push-based verification) is where most small businesses have landed because it’s convenient. One tap and you’re in. That convenience is also the vulnerability.

To be clear: push MFA is still dramatically better than no MFA. An attacker who just has your password without a fatigue attack to bypass MFA still can’t get in. The point is that fatigue attacks are a known technique specifically designed to exploit push-based MFA, and the defence requires going slightly beyond “we have MFA enabled.”

What Actually Stops It

Number matching and additional context. Microsoft and Google have both added number matching to their push MFA: when you get a notification, it shows a number that you also have to type into your authenticator app. You can’t accidentally tap approve because there’s an extra step requiring you to see both the login screen and your phone. Enable this in your Microsoft 365 admin settings if you haven’t already. It’s the single most effective countermeasure for push-based MFA fatigue.

Passkeys and FIDO2 hardware keys. Passkeys (supported by iOS, Android, Windows, and most modern browsers) are phishing-resistant by design. They’re tied to the specific website they were created for and can’t be replicated by a fake login page. A FIDO2 hardware key (a YubiKey, for example, from around £45) is even more robust. For the highest-risk accounts in your business — company director, financial accounts, payroll access — a hardware key is worth the cost.

Setting limits on MFA notification frequency. Microsoft 365 allows administrators to configure policies that limit push notifications. If someone exceeds a threshold of failed MFA attempts in a short period, the account can be flagged or temporarily locked. Check your Conditional Access policies if you’re on Microsoft 365 Business Premium (if you’re on the basic plan, you may not have access to this).

Educating staff about the attack pattern. This is uncomfortable because you’re asking people to recognise a social engineering attack rather than a technical one. But telling your staff “if you get multiple MFA notifications you didn’t initiate, do not approve them, and call IT or your manager immediately” is genuinely useful. The attack depends on the target not understanding what’s happening.

Reporting and Recovery

If you suspect someone in your organisation has approved a fraudulent MFA request, move quickly. Change the compromised account’s password immediately, revoke active sessions in your Microsoft 365 or Google Workspace admin console, check for any mail forwarding rules or inbox rules the attacker may have created, and look at recently accessed files.

Report to Action Fraud (actionfraud.police.uk) and, if customer or employee data may have been accessed, notify the ICO within 72 hours of becoming aware of the breach. Under UK GDPR that notification obligation is strict, and the ICO has been clear that being the victim of an attack doesn’t eliminate the reporting requirement.

Cyber Essentials certification (from £300 per year for small organisations) covers MFA as part of its access control requirements and gives you a baseline framework for checking your configuration is correct. It’s not a silver bullet, but it’s a reasonable starting point for SMEs that don’t have an internal IT team to assess their own setup.