# What is MFA fatigue?

MFA fatigue, also called push bombing, is an attack on accounts that use push notifications for multi-factor authentication. The attacker already has the password, often from phishing or a leak, and triggers login attempts over and over, so that the user's phone keeps asking for approval, sometimes late at night. Eventually the person taps approve to make it stop, or a caller posing as IT talks them into it. Defences: switch push approvals to number matching, where the user must type a number shown on the login screen, which Microsoft Authenticator now applies by default; limit the number of prompts per period; let users report unexpected prompts with one tap; and move high-risk accounts to phishing-resistant methods such as security keys or passkeys. Tell staff plainly that an MFA request they did not start means someone has their password, and that they should deny it and call IT.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/what-is-mfa-fatigue

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can phishing get past multi-factor authentication?](https://netsenx.com/en/faq/can-phishing-bypass-multi-factor-authentication)
- [Does a password reset end a mailbox takeover?](https://netsenx.com/en/faq/does-a-password-reset-end-a-mailbox-takeover)
- [What are deepfake CEO calls, and how do we protect against them?](https://netsenx.com/en/faq/what-are-deepfake-ceo-calls)
- [What is a fake CAPTCHA or ClickFix attack?](https://netsenx.com/en/faq/what-is-a-fake-captcha-clickfix-attack)
- [Are e-mail attachments still dangerous?](https://netsenx.com/en/faq/are-email-attachments-still-dangerous)