MFA Fatigue Attacks: Stopping Push Bombing With Training

Multi-factor authentication was supposed to be the safety net under stolen passwords. Push bombing turns the net itself into the attack: flood an employee with approval prompts until muscle memory, annoyance or confusion produces a single tap on 'Approve.' One tap is all it takes - and the attacker walks in through the front door of your identity provider with a fully authenticated session.

How Push Bombing Works - and How Often

The mechanics are almost embarrassingly simple. The attacker already holds a valid username and password, typically bought from an infostealer log or a prior breach. They attempt to sign in, over and over, and each attempt fires a push notification to the legitimate user's phone. Some victims approve to make the buzzing stop. Some approve because they assume it is a glitch. Some approve simply because approving is what they do a dozen times a day.

The scale of the technique was quantified early. Microsoft Entra telemetry from 2022 - a figure worth labeling clearly as that vintage - recorded roughly 382,000 MFA fatigue attacks over a 12-month period, about 6,000 per day, as documented on Microsoft's Entra blog. The same telemetry showed that around 1 percent of users accept the very first unexpected push they receive. One percent sounds small until you multiply it across an enterprise: in a 5,000-person company, that is dozens of employees who will let an attacker in on the first try, no persistence required.

Why Conventional MFA Is No Longer Enough

Push bombing is one member of a family of techniques that treat conventional MFA as an obstacle to route around rather than a wall to break through. The Verizon 2025 Data Breach Investigations Report found that 22 percent of breaches began with stolen credentials - and documented how attackers bypass conventional MFA through prompt bombing, token theft and adversary-in-the-middle kits that proxy the real login page and capture the session cookie after the victim authenticates.

The common thread across all three: the attacker never defeats the cryptography. They defeat the human workflow wrapped around it. That is why the defense has to address both the mechanism and the person holding the phone.

The Technical Half: Number Matching and Phishing-Resistant MFA

The interim fix for push bombing specifically is number matching: instead of a one-tap 'Approve' button, the login screen displays a number that the user must type into their authenticator app. An employee being bombed cannot accidentally approve a login they did not initiate, because they never see the number the attacker's session displays. Microsoft has enabled number matching by default since May 2023, and Okta and other identity providers offer it as a recommended setting against prompt bombing.

The durable fix goes further. The Microsoft Digital Defense Report 2025 found that phishing-resistant MFA - FIDO2 passkeys and hardware-bound credentials - blocks more than 99 percent of identity-based attacks. There is no push to bomb, no code to relay and no session to proxy, because the credential is cryptographically bound to the legitimate device and the legitimate site.

A pragmatic rollout order for most organizations: confirm number matching is enforced everywhere today, then migrate high-privilege and high-risk accounts to phishing-resistant methods first, expanding outward as hardware and passkey support allows.

The Human Half: Never Approve the Unexpected

Technology narrows the window, but training closes it - and the training message fits in one sentence: never approve an authentication prompt you did not just trigger yourself.

For that rule to hold under pressure, employees need three things:

• The reflex. An unexpected prompt is not noise to be cleared - it is evidence that someone, somewhere, has your password and is using it right now. That reframing turns annoyance into alarm, which is exactly the response you want.
• The reporting path. Every denied unexpected prompt should be reported to security immediately. A report of push bombing is free breach detection: it tells you which credential is compromised before the attacker succeeds, letting you force a reset while the account is still safe.
• The safety to slow down. Employees who fear blame for 'causing login issues' will quietly approve to make problems disappear. Make it explicit that denying and reporting is always the right call, even when the prompt turns out to be a colleague's typo.

Habits like these are built through repetition, not memos. Ongoing security awareness training that rehearses the deny-and-report response - the same way phishing simulation builds the hover-and-check reflex for email - is what turns a one-line policy into behavior that survives a 2 a.m. notification storm. Platforms like empowsec exist precisely to make that reinforcement continuous rather than a once-a-year slide deck.

Key Takeaways

• Push bombing weaponizes habit: Microsoft's 2022 Entra telemetry logged roughly 382,000 MFA fatigue attacks in 12 months, with about 1 percent of users approving the very first unexpected push.
• Credentials remain the front door: the Verizon 2025 DBIR ties 22 percent of breaches to stolen credentials, with conventional MFA bypassed via prompt bombing, token theft and adversary-in-the-middle kits.
• Enforce number matching now - Microsoft has enabled it by default since May 2023, other IdPs offer it as a recommended setting, and it removes the one-tap approval that push bombing depends on.
• Move toward phishing-resistant MFA: Microsoft's 2025 Digital Defense Report finds it blocks more than 99 percent of identity-based attacks.
• Train one rule relentlessly: never approve a prompt you did not trigger - deny it, report it, and treat every unexpected push as a live compromise signal.