TL;DR:

  • MFA fatigue (also called MFA bombing or push spam) is when attackers flood your phone with authentication approval requests until you accidentally — or deliberately, out of frustration — tap approve.
  • It’s bypassing MFA for major organisations and it works just as well against small businesses.
  • The fix isn’t to remove MFA — it’s to switch to a type of MFA that doesn’t use push notifications.

Multi-factor authentication is one of the most important security controls you can implement. It stops the vast majority of account takeover attacks. If you use MFA, you’re much better protected than if you don’t.

But there’s a catch that’s become increasingly relevant: one of the most common forms of MFA — push notifications on your phone — has a well-known weakness that attackers are actively exploiting. And it doesn’t require any technical skill to pull off.

What MFA Fatigue Is

Here’s how it works.

An attacker gets your username and password. This is easier than it sounds — credentials are bought from data breach dumps for pennies, or obtained via a phishing email, or simply guessed if your password isn’t strong. Having your login credentials alone isn’t enough to access your account if you have MFA enabled.

But with push-based MFA (the kind where your phone buzzes and asks you to tap “Approve”), the attacker can just… keep trying. They send login attempt after login attempt. Each one triggers a push notification to your phone. Most people, when they receive a surprise notification asking them to approve a login they didn’t initiate, will reject it or ignore it.

So the attacker keeps going. They might send dozens of requests over several hours, often in the middle of the night. Eventually, a few things can happen:

  • You get fed up with the notifications and tap Approve just to make them stop
  • You confuse one of the attacker’s requests for a legitimate login you were expecting
  • You contact IT support, who, in resolving the problem, accidentally approve access
  • The attacker calls you posing as IT support and tells you to tap Approve to “clear the issue”

That last step — social engineering layered on top of the spam — is how this attack has compromised some very large organisations. The attacker doesn’t need to break the MFA. They need you to bypass it for them.

Why This Matters for Small Businesses

You might be thinking this is an enterprise problem. It isn’t. Small businesses are attractive targets precisely because they often have less rigorous security practices and less-trained staff.

Your Microsoft 365, Google Workspace, accounting software, banking portal, and CRM are all protected by (you hope) MFA. If any of those accounts use push-notification MFA, they’re potentially vulnerable to this attack.

The consequences depend on which account is compromised. A business email account can be used to authorise fraudulent payments, redirect invoices to attacker-controlled bank accounts, or send phishing emails to your clients in your name. Your accounting software has everything needed to file a false tax return or redirect payments. Your banking portal access is obvious.

What to Do About It

The solution isn’t to remove MFA. MFA is still one of the single most effective security controls available. The solution is to use a form of MFA that doesn’t rely on push notifications.

Number matching. Microsoft and Google have both added number matching to their authenticator apps. Instead of a simple approve/deny prompt, your phone shows you a two-digit number that you have to match against a number displayed on the login screen. The attacker who doesn’t have physical access to your screen can’t complete this step. Enable number matching if your authenticator app supports it — in Microsoft Authenticator it’s in the settings, and Microsoft now requires it by default for new tenants.

Authentication apps with TOTP codes. Time-based one-time passwords (the six-digit codes that change every 30 seconds) don’t suffer from the same fatigue problem. There’s no notification to spam. The attacker needs the current code, which they can only get from your device. If you’re using SMS codes or push notifications, switching to an authenticator app with TOTP codes (Google Authenticator, Authy, Microsoft Authenticator in TOTP mode) is an improvement.

Hardware security keys. A physical key (like a YubiKey) that plugs into your USB port or taps against your phone is the strongest option. No push notification, no code to steal. The key proves you physically possess it. Attackers cannot remotely compromise a hardware key. For small businesses protecting high-value accounts (banking, accounting, admin email), hardware keys are worth the £25-50 cost per key.

Passkeys. Many services now support passkeys — a newer standard that replaces passwords and traditional MFA entirely. Passkeys use your device’s biometrics (fingerprint, face) and are tied to the specific website, so phishing attacks don’t work either. If your accounts support passkeys, enabling them is worth doing.

Tell Your Team

Technology changes are more effective when combined with awareness. Make sure everyone in your business knows:

  • An unprompted MFA notification means someone has your password. It’s not a system glitch. It means an attacker is attempting to log in right now.
  • The right response is to deny the request and immediately change the password on that account.
  • If you’re getting repeated MFA requests, report it as a security incident — don’t just keep denying and assume it’ll stop.
  • No legitimate IT team will ever ask you to approve an MFA request as part of troubleshooting.

That last point is important. The most successful MFA fatigue attacks combine push spam with a follow-up call from someone claiming to be IT support. “Hi, it’s [IT company name], we’re seeing an authentication issue on your account — could you approve the notification we’ve just sent?” If you get this call, hang up and call your IT provider back on a number you already have.

Quick Action Checklist

If you’re currently using push-based MFA, here’s what to do:

  1. Enable number matching in your authenticator app if it’s available (Microsoft Authenticator: Settings → Number matching; Google Workspace: Admin Console → Security → 2-Step Verification).

  2. Brief your staff on what MFA fatigue is and what to do when they receive an unexpected notification.

  3. For your highest-risk accounts (banking, accounting, admin email), consider hardware security keys.

  4. Check whether passkeys are available for your main services — Microsoft 365, Google Workspace, and most banking portals have rolled them out.

  5. Review your incident response plan — if an account does get compromised, how quickly can you detect it, lock it down, and understand what was accessed?

MFA fatigue is a reminder that security controls can be weakened by human factors, not just technical ones. The right response isn’t cynicism about security — it’s upgrading to approaches that remove the human decision from the critical path.