MFA Fatigue

Multi‑Factor Authentication (MFA) is one of the strongest defenses against attackers.
But attackers have learned a new trick:

They overwhelm users with nonstop MFA prompts until someone finally clicks “Approve.”

This is called MFA fatigue (or “push bombing”).

It’s a social engineering attack that targets human behavior, not technology.

Think of it like a criminal repeatedly buzzing your apartment intercom at 2 a.m.
Eventually, someone might hit “unlock” just to make the noise stop.

Digitally, MFA fatigue attacks involve:

• sending dozens or hundreds of MFA push notifications
• triggering prompts at odd hours
• pretending to be IT and asking the user to “approve a login”
• hoping the user gets annoyed, confused, or tired
• exploiting trust and urgency

Once the user approves one prompt, the attacker gains full access to the account.

Why this matters for insurance:
MFA fatigue is now a common cause of:

• Business Email Compromise (BEC)
• unauthorized access to cloud systems
• payroll or invoice fraud
• data exposure
• ransomware deployment
• privilege escalation

And because the user technically “approved” the login, it can complicate:

• claims
• forensics
• legal analysis
• incident response timelines

When a company says, “We had MFA, but the attacker still got in,” the real question is:

“Was the MFA method strong — or was it vulnerable to fatigue attacks?”

The takeaway:
MFA is powerful, but not all MFA is equal.
Push‑based MFA can be manipulated.
Number‑matching, hardware keys, and phishing‑resistant MFA dramatically reduce this risk.

Pop Culture Parallel:
In Groundhog Day, the same event repeats over and over until the character finally gives in. MFA fatigue works the same way — repetition wears people down until they approve something they shouldn’t.

Real‑World Example:
In 2022, attackers used MFA fatigue to breach Uber’s internal systems. They bombarded an employee with push notifications until he approved one, giving the attackers access to critical tools and systems.

Vocabulary Reinforcement (from earlier posts)

• MFA
• Phishing
• Social Engineering
• Credential Access
• Business Email Compromise (BEC)
• Initial Access
• Privilege Escalation
• EDR
• SIEM