MFA fatigue exposes a usability gap in human identity security

At a glance

What this is: This article argues that MFA fatigue is a real human identity security problem, because repeated prompts can condition users to approve access without careful verification.

Why it matters: It matters because IAM teams cannot treat MFA as a purely technical control when user behaviour and prompt design can undermine assurance across human identity programmes.

Context

MFA fatigue is a human identity governance problem, not just an authentication nuisance. When repeated prompts become normal, the control starts depending on sustained user vigilance rather than on reliable verification design, and that assumption is unstable in modern work patterns.

The article focuses on push-based MFA, prompt bombing, and user habituation. In practical terms, the security gap is between what the control expects of people and what people can realistically sustain when notifications, urgency, and routine access requests pile up.

Key questions

Q: What breaks when users can be bombarded into approving MFA prompts?

A: The control breaks when approval is treated as proof of intent. Repeated prompts, urgency, and impersonation can turn a legitimate authentication step into an attacker success path, especially for privileged or remote users. Teams should assume that prompt volume can be weaponised and design access flows so a single mistaken approval does not expose high-value systems.

Q: Why does prompt bombing increase account takeover risk?

A: Prompt bombing increases takeover risk because it turns a legitimate authentication channel into a pressure tactic. The attacker does not need to steal a factor if they can get the target to approve access. The risk is highest when approval-based MFA is used for sensitive systems and when the user experience makes repeated requests feel routine.

Q: How should security teams reduce the risk of MFA fatigue attacks?

A: Security teams should remove approval-based MFA from high-risk access paths, replace it with cryptographic authentication, and reduce the privileges attached to any successful session. They should also detect repeated prompt events as attack signals, not user noise, and trigger response when requests spike unexpectedly.

Q: Should organisations keep push-based MFA for all applications?

A: No. Push-based MFA is reasonable for lower-risk use cases, but it becomes fragile where a single approval opens access to sensitive data or administration tools. Teams should reserve stronger verification for high-impact systems and use contextual challenge policies so authentication matches the risk of the session.

Technical breakdown

How prompt bombing exploits push-based MFA

Prompt bombing works by overwhelming a user with repeated login requests until they accept one out of fatigue, annoyance, or confusion. The attack does not need to break the authentication protocol itself. It targets the human decision point at the end of the flow, where a simple tap or approval becomes the access grant. This is why push notification MFA is attractive to attackers: the control can be technically intact while the user response is conditioned into a yes. The weakness is behavioural, but the impact is still a full authentication bypass.

Practical implication: reduce reliance on approval-only prompts for high-risk access paths and force stronger user verification when the request context is abnormal.

Why MFA usability drives security outcomes

Usability is not a soft concern in authentication. Each extra code entry, app switch, or repeated challenge adds cognitive friction, and friction predictably changes user behaviour. People skip details, approve faster, reuse devices, or mentally downgrade the meaning of a prompt when the experience becomes repetitive. In governance terms, that means the security control is partly shaped by human tolerance, not just policy strength. If the control creates constant interruption, the organisation is effectively training users to ignore it. That makes the interface part of the attack surface.

Practical implication: assess authentication workflows as user journeys and remove unnecessary repetition before attackers exploit fatigue as a condition of use.

How adaptive MFA changes the assurance model

Adaptive MFA shifts the question from whether to challenge a user to when a challenge is justified. It uses context such as device familiarity, location, and access timing to decide whether the session looks normal enough to proceed with less friction. That is a different governance model from blanket prompting, because the system is no longer asking for the same verification every time. For human identity security, that reduces alert fatigue without abandoning risk-based control. The downside is that weak contextual signals can miss unusual but legitimate access, so the policy has to be tuned carefully.

Practical implication: move routine access toward risk-based challenges and reserve stronger prompts for sessions that depart from known user context.

Threat narrative

Attacker objective: The attacker’s objective is to turn user fatigue into valid access without needing to defeat the authentication system directly.

1. Entry begins when the attacker induces repeated authentication prompts against a legitimate user account, often through push-based MFA notification flooding.
2. Credential abuse occurs when the target approves one of the prompts out of frustration, fatigue, or confusion, granting the attacker a valid authenticated session.
3. Impact follows once the attacker uses that session to reach internal tools and resources as the authenticated user.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MFA fatigue is a human control failure, not a user training problem. The repeated-prompt pattern shows that authentication systems can be functionally correct while still producing insecure outcomes because people are asked to stay vigilant far beyond normal attention limits. That makes usability part of the security model, not a cosmetic concern. The practical conclusion is that human identity controls need to be judged by how they shape decisions under pressure, not by how many prompts they can generate.

Prompt bombing exposes a governance assumption that users will notice and resist every challenge. That assumption is designed for low-frequency authentication events, but it fails when attackers can force multiple prompts in rapid succession and wear down the user response. The implication is that approval-based MFA cannot be treated as inherently robust simply because it is multifactor. Practitioners need to recognise that user vigilance is a finite security resource, not a reliable control boundary.

Adaptive authentication is becoming a governance requirement, not an optimisation. The article’s core point is that static, repetitive prompts create the very conditions attackers exploit. Risk-based challenge logic, device context, and session-aware policies are therefore central to human IAM resilience. The practical conclusion is that teams should stop measuring MFA only by coverage and start measuring whether the experience suppresses or amplifies fatigue.

Human identity security now sits at the intersection of UX and trust architecture. If authentication feels punitive, users will search for shortcuts, and attackers will convert that shortcut behaviour into access. That is why passkeys, SSO, and biometric flows matter beyond convenience: they reduce the chance that the workforce will be conditioned into careless approvals. The practical conclusion is that the control stack must be designed around user behaviour, not idealised user discipline.

Usability debt is becoming an identity risk metric. Repeated friction accumulates until the control ceases to behave as intended, which means a secure policy can still produce insecure operations when it is hard to use. That pattern deserves the same attention as configuration drift or privilege creep. The practical conclusion is that identity teams should treat repeated-interruption design as a measurable governance defect, not an inevitable side effect.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Usability debt is now an authentication control issue. Repeated challenge fatigue means the workforce can be trained into unsafe approval habits even when the underlying MFA technology is sound. Identity teams should evaluate how often their users are interrupted, not just whether MFA is enabled.

Approval-based MFA needs a higher-risk boundary. When the same tap approves both low-risk sign-ins and sensitive access, attackers only need to create enough repetition to make the user stop evaluating prompts. The practical shift is to reserve more resistant verification for privileged and high-impact paths.

For practitioners

• Audit prompt frequency and approval paths Map where users receive repeated MFA requests, then separate normal access from abnormal access so high-risk requests do not look routine. Focus on push notification loops, recurring approvals, and any workflow that conditions users to tap through without reading.
• Introduce context-aware challenge policies Use device familiarity, location, and session risk to decide when MFA should step up, rather than prompting on every login. The goal is to reduce unnecessary friction while preserving stronger verification for unusual access patterns.
• Replace approval-only paths for sensitive access For privileged or high-impact applications, require stronger verification than a single yes/no notification so one fatigued response cannot complete the login. This is especially important where a single session reaches administrative tools or sensitive records.
• Train users to report prompt storms Make repeated, unexpected MFA prompts a reportable event so security teams can distinguish fatigue from an active attack. The signal is operationally useful only if users know that multiple unexpected requests are abnormal.

Key takeaways

• MFA fatigue turns user frustration into a security weakness when repeated prompts become normal enough to trigger automatic approval.
• The attack pattern matters because prompt bombing can convert a legitimate authentication workflow into a valid access path without credential theft.
• The strongest mitigation is not more alerts, but better authentication design that reduces unnecessary prompts and raises verification only when context demands it.

Key terms

• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• Prompt Bombing: An attacker technique that floods a user with repeated MFA requests until one is approved out of confusion, fatigue, or annoyance. It works because the control depends on a human making a quick decision under pressure, rather than on a factor that cannot be socially engineered.
• Adaptive MFA: A multi-factor authentication pattern that changes the challenge based on user context, risk, and policy. It reduces unnecessary friction by avoiding one-size-fits-all prompts, while still increasing assurance when a session, device, or location looks unusual.
• Approval-based authentication: Approval-based authentication is an MFA pattern where a user confirms access by accepting a prompt, often on a trusted device. It is easy to use, but repeated approvals can train users into reflexive responses if the process is overused or poorly contextualised.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.