Detect this by monitoring for repeated MFA prompts or push requests that the user did not initiate. Sudden bursts of approvals, fatigue-style prompting, or MFA activity from unusual geographies, devices, or times indicate abuse. Correlate the requests with failed password attempts, suspicious sign-ins, and token replay indicators, then rate-limit or challenge repeated prompts.
How to spot MFA request generation in the signal stream
MFA request generation is usually visible before an account is fully compromised, because the attacker needs the victim to approve or dismiss repeated prompts. Look for sequences of push notifications, number challenges, or OTP requests that do not line up with an active user session, especially when the same identity receives multiple prompts in a short window or from a suspicious source of authentication traffic.
The strongest early indicators are pattern based: repeated prompts after failed password attempts, bursts of approvals after hours, and requests tied to new geographies, unfamiliar devices, or impossible travel. A useful detection rule is not just “many MFA events,” but “MFA events that do not match the user’s normal login cadence, device posture, or location history.”
When teams need a practical baseline for hardening sign-in detection and prompt resistance, the MFA Guide is the best starting point for understanding which MFA methods are easier to abuse and which signals are most useful to monitor.
Correlate prompts with the attacker path, not just the prompt itself
MFA request generation is more actionable when it is correlated with adjacent identity events. Failed password sprays, suspicious sign-ins, token replay indicators, help desk reset activity, and recovery-flow abuse often appear around the same time as prompt bombing. That correlation helps distinguish a noisy user experience issue from an active adversary trying to force a fatigue response or harvest an approval.
Teams should also watch for prompt generation that follows a successful primary-factor login but precedes an access token exchange from a different device, browser, or ASN. That pattern can indicate an attacker has valid credentials and is trying to defeat the second factor, not merely probe the account. If the MFA system supports number matching, verify whether the prompt volume increases when the attacker cannot complete the second step quickly.
The attack path becomes clearer when you compare the prompt pattern with established MFA bypass behaviour. NHIMG’s MFA Fatigue and Bypass Guide covers prompt bombing, fallback abuse, and other abuse paths that explain why prompt spikes matter operationally.
Turn detection into containment before the user gets worn down
Detection should trigger a response that reduces prompt amplification. Rate-limit repeated prompts, pause further challenges after a suspicious burst, and force a step-up control or manual verification when the request pattern becomes abnormal. If the user reports unexplained prompts, treat that as a live warning sign rather than a benign nuisance, because fatigue attacks depend on delayed response.
Also verify whether the account has already been partially exposed through valid credentials, session theft, or a compromised recovery path. A team that only blocks the next prompt can still miss the real issue if the attacker has access through a remembered device, an active session, or a reset channel. For that reason, prompt generation detection should feed into session review, credential hygiene checks, and any necessary MFA reset or re-enrollment workflow.
In practice, teams get better outcomes when they connect prompt anomalies to the broader identity stack, not just the authenticator. The Workforce Identity Security Guide is useful for mapping prompt abuse to surrounding controls such as SSO, recovery, and session hygiene, while the Passwordless and Passkeys Guide shows how phishing-resistant authentication reduces the opportunity for request-generation abuse in the first place.
Risk and Threat Considerations
MFA request generation is dangerous because the attack is often low-noise, repetitive, and psychologically targeted. The threat is not the prompt alone, but the cumulative pressure it creates, especially when an attacker already has a password or an active foothold and only needs one approval.
Failure mechanism: Attackers generate repeated authentication challenges until the user accepts one, or they use the resulting attention gap to pair prompt abuse with credential replay, session theft, or account recovery abuse.
Impact: A single successful approval can grant access to email, SSO, VPN, or admin tooling, after which the attacker may persist through session tokens, reset channels, or downstream privilege escalation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Repeated MFA prompts and prompt abuse depend on authenticator lifecycle and misuse. |
| IA-2 — Identification and Authentication (Organizational Users) | The issue is anomalous authentication activity against user accounts and sign-in flows. | |
| AU-6 — Audit Review, Analysis, and Reporting | Detection depends on correlating MFA events with failed logins and suspicious sign-ins. | |
| Recommendation — Review and limit authenticator use, rotation, and reauthentication rules when prompt abuse is detected. Require stronger authentication signals and monitor anomalous organizational-user sign-ins. Correlate authentication logs, failed attempts, and location anomalies to identify MFA request abuse. | ||
| OWASP ASVS | V6 — Authentication | MFA prompt generation is an authentication abuse pattern that needs explicit verification controls. |
| Recommendation — Validate authentication flows for MFA abuse resistance and abnormal prompt handling. | ||
| MITRE ATT&CK | T1621 — Multi-Factor Authentication Request Generation | This is the precise adversary technique being detected and correlated. |
| Recommendation — Map detections to T1621 and alert on repeated challenge generation, fatigue patterns, and related sign-in anomalies. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The question concerns MFA behavior, assurance, and phishing-resistant authentication signals. |
| Recommendation — Use NIST digital identity guidance to prefer phishing-resistant authenticators and reduce prompt abuse. | ||
Practitioner Guidance
What to verify: Confirm whether the prompt burst is tied to one account or spreading across many users, because a targeted fatigue attack and a broader credential attack generate different alerting and response priorities. Also check whether approvals are coming from expected devices and whether the user’s login history shows preceding failed attempts, unfamiliar geographies, or fresh sessions.
Decision rule: If the same account receives repeated prompts without a corresponding legitimate user action, suppress further pushes, escalate the sign-in for review, and inspect for token or session abuse before re-enabling normal authentication flow.
Practitioner takeaway: Treat prompt generation as an attack precursor, not a user-experience anomaly, and judge it by whether the authentication pattern is forcing human error or signalling a deeper credential compromise.
Related resources from NHI Mgmt Group
- What do security teams get wrong about multi-factor authentication in browser-based login flows?
- How should security teams use fingerprint verification in multi-factor authentication without creating weak fallback paths?
- How should security teams implement multi-factor authentication for sensitive access without creating user workarounds?
- How should security teams implement iris biometrics in multi-factor authentication without over-relying on them?