How does push-notification authentication work, and what is an MFA fatigue attack?

A login attempt sends a prompt to an app on the user's registered phone, which the user simply approves; in an MFA fatigue attack an attacker who already has the password floods the user with prompts until they approve one by mistake or to make it stop.

Push authentication is very convenient: no code to type, just tap "approve". But exactly that convenience is the weakness. The user approves a request without any link to the login they are actually doing, so a prompt triggered by an attacker looks the same as their own.

The attack pattern (also called MFA bombing):

1. The attacker obtains the password (phishing, credential stuffing).
2. They trigger login after login, each sending a push prompt.
3. The user, annoyed or confused, often after a fake call from "IT support", eventually taps approve.

Countermeasures:

• Number matching: the login screen shows a number that must be typed into the app, so approving requires seeing the real login screen. NIST likewise recommends transferring a secret instead of a plain approve tap.
• Limits on the number of prompts, and alerts on denied ones (a denied prompt often means the password is compromised).
• Moving to phishing-resistant authenticators where possible.

Go deeper:

• Multi-factor authentication: Fatigue attack (Wikipedia) — the attack, number matching and CISA's advice.
• NIST SP 800-63B-4: Out-of-band authenticators — how out-of-band approval and secret transfer are specified.