MFA fatigue and push bombing: When the second factor becomes the weak link

Multi-factor authentication was sold for years as the answer to weak passwords, and in many ways it was. It stopped credential stuffing, blunted phishing, and made account takeover dramatically harder. But attackers adapt, and by 2024 they had found a way to turn the second factor against its own users. MFA fatigue, and the push bombing that triggers it, became one of the most effective social engineering techniques in the wild. Here is how the attack works and how security awareness training can help employees resist it.

What MFA fatigue actually is

MFA fatigue exploits a very human weakness: the desire to make an annoyance stop. When an attacker already has a victim's password, they trigger login attempt after login attempt. Each attempt fires a push notification to the victim's phone asking them to approve the sign-in. After dozens of prompts, the victim, exhausted and wanting the pestering to end, taps approve just to make it stop. That single tap hands the attacker access. The attack does not require breaking the second factor, it requires wearing down the person holding it.

Push bombing: the flood that starts it

Push bombing is the automated delivery of those approval requests. Attackers script the login attempts so that the victim's device buzzes relentlessly, often in the middle of the night or during a busy workday when the victim is distracted and less likely to think critically. Some campaigns escalate further, following up the flood with a phone call from a fake IT support person who claims they are helping resolve the very lockout the attacker caused. The combination of exhaustion and a friendly voice is extremely effective.

The attacks that made it famous

MFA fatigue entered the mainstream conversation after a series of high-profile incidents. Attackers used the technique to breach major companies and technology providers, in some cases moving from a single fatigued employee to a broad compromise of customers and partners. The details became case studies in how a sophisticated attack can still begin with one person clicking approve. By 2024, these stories had made MFA fatigue a recognized term in security training, not an obscure technique.

Why MFA is still not enough

None of this means MFA is a bad idea, far from it. The lesson is that MFA is a control, not a complete solution, and like every control it can be defeated by human error. The presence of a second factor does not remove the need for awareness. In fact, it shifts it: employees need to understand that the approve button is a security decision, not a convenience, and that approving a login they did not initiate is exactly what the attacker is counting on.

What employees need to be taught

Security awareness training should now include specific, actionable guidance on MFA fatigue. Employees should learn to: never approve a login request they did not initiate, even if it keeps repeating; treat a flood of unexpected push notifications as a sign of an active attack, not a glitch; verify any follow-up call claiming to be from IT through a separate, known channel before acting; and report suspicious push requests immediately. The core message is simple: when in doubt, deny and report.

Technical defenses that support the training

Training works best when the technology makes the right decision easier. Organizations can reduce MFA fatigue risk by: enabling number matching, where the user must type a number shown on screen rather than just tapping approve; using phishing-resistant factors like passkeys or hardware security keys where possible; and setting lockout or alerting policies that flag an unusual volume of failed attempts. These controls shrink the attack surface and give employees a clearer, less ambiguous choice.

The durable lesson

MFA fatigue is a reminder that attackers target people, not just systems. Every control an organization deploys will eventually be tested against the humans who use it, and training is what determines whether those humans make the right call under pressure. Teaching employees to recognize fatigue attacks, and giving them a clear, safe way to deny and report, is one of the highest-value things a security awareness program can do in 2024, and the evidence that this kind of training works is laid out in whether awareness training reduces security incidents.