They create risk because they depend on a user action that attackers can influence through fatigue, phishing or real-time relay. Once the factor can be approved, intercepted or replayed, it no longer provides durable proof of identity. Security teams should treat these methods as transition controls, not the end state for sensitive access.
Why push prompts and OTPs fail as durable proof of identity
Push approvals and one-time passwords both depend on a user action that can be steered, intercepted, or repeated under pressure. That makes them useful for step-up checks, but weak as a lasting trust signal when the attacker can influence the approval moment or race the code in real time.
Push fatigue, real-time phishing, and relay attacks all exploit the same flaw: the factor proves that someone interacted, not that the right person independently authenticated the request. NHIMG’s MFA Guide and NIST SP 800-63 Digital Identity Guidelines both point practitioners toward phishing-resistant methods when the access decision really matters.
OTPs are especially brittle when delivery, entry, and verification happen in a short window. If the attacker can capture the code, prompt the victim to type it into a fake login, or relay it before expiry, the control can still “succeed” while the session belongs to the attacker.
Where the identity risk actually comes from
The core issue is not that push prompts and OTPs are broken in every setting, but that their assurance is conditional. They rely on human reaction, network timing, and a single approval event, which means the control is vulnerable to coercion, confusion, and session hijack at the exact moment trust is being granted.
This is why they work better as transition controls than as end-state controls. They can reduce casual reuse of passwords, but they do not provide strong resistance to adversary-in-the-middle phishing, MFA fatigue, token replay, or approval spam once the attacker is already in the interaction path.
That limitation is most serious for privileged users, high-value systems, and anything with broad blast radius. The weaker the assurance of the second factor, the more the environment depends on compensating controls such as device binding, phishing-resistant authenticators, risk-based access policy, and session monitoring.
Identity Security Posture Management (ISPM) Guide is useful here because it frames MFA coverage as only one posture signal, not proof that the access path is actually resilient.
What changes when you treat them as temporary controls
Once push and OTP methods are treated as transitional, the design goal changes from “does this authenticate?” to “how quickly can this be bypassed, and what is the blast radius if it is?” That leads to better decisions about where these factors are still acceptable, and where they must be replaced with stronger assurance.
For lower-risk workflows, push or OTP can remain an operational step while teams phase in stronger methods. For sensitive access, especially admin, remote, or third-party access, the safer pattern is to require phishing-resistant MFA and to reduce reliance on human judgment at the point of login.
Third-Party, B2B and Contractor Access Guide and IAM and Identity Provider Buyer’s Guide are both relevant because they reflect the practical choice practitioners face: preserve usability where risk is modest, and upgrade assurance where trust failure would be costly.
Risk and Threat Considerations
Push prompts and OTPs are attractive to attackers because they can be defeated without breaking the underlying password, which makes them efficient targets for phishing kits, social engineering, and real-time relay. The danger is not just initial compromise, but attacker persistence through a legitimately issued session that the victim helped authorize.
Failure mechanism: the attacker induces approval, captures a code, or relays the authentication flow fast enough that the factor is accepted even though the attacker controls the request path.
Impact: the environment may record a successful login while the attacker gains access, escalates privilege, or reuses the session until detection or revocation occurs.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Phishing-resistant authenticators and assurance levels govern this exact identity-risk problem. |
| Recommendation — Adopt phishing-resistant authenticators for sensitive access and use assurance levels to match method strength to risk. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Push and OTP factors are organizational user authentication controls whose strength must match access sensitivity. |
| IA-5 — Authenticator Management | The issue centers on authenticator lifecycle, reuse, and the weakness of reusable or relayable factors. | |
| IA-9 — Identification and Authentication (Non-Organizational Users) | Contractor and external-user access often uses the same weak push and OTP patterns. | |
| Recommendation — Strengthen organizational authentication with phishing-resistant methods for high-value accounts. Manage authenticator issuance, expiry, and replacement so weak factors are retired from sensitive access. Apply stronger authentication requirements to external and partner access paths. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Relayable OTP and approval flows are a direct authentication weakness when exposed through APIs and login flows. |
| Recommendation — Harden authentication flows against replay, interception, and session theft. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Relayable codes and approval prompts create weak authentication assurance in non-human and human-mediated access paths. |
| NHI-07 — Long-Lived Secrets | OTP and push workflows often coexist with reusable secrets and sessions that extend compromise impact. | |
| Recommendation — Replace relayable authentication factors with stronger, bound authentication methods. Reduce secret lifetime and remove reusable access paths from sensitive systems. | ||
| MITRE ATT&CK | Credential Access | The described abuse includes phishing, relay, and capture of authentication material. |
| Recommendation — Map observed MFA abuse to credential-access and relay techniques for detection and hunting. | ||
Practitioner Guidance
What to verify: confirm whether the factor is phishing-resistant, bound to the device or origin, and resistant to replay. If the answer is no, treat it as a transitional measure rather than proof that the account is well protected.
Decision rule: if the access path can reach privileged systems, production data, or third-party integrations, move away from push and OTP first; if the path is low impact and tightly monitored, they can remain temporarily while stronger controls are rolled out.
What good looks like: approval requires a method that cannot be casually relayed or fatigue-approved, and login events are paired with clear visibility into unusual prompts, repeated denials, or abnormal geography and device changes.
Practitioner takeaway: the control objective is not to eliminate every second factor, but to stop treating user-confirmed prompts and short-lived codes as durable identity proof where the access decision carries meaningful risk.