Topic starter
24/06/2026 9:50 pm
TL;DR: Repeated MFA prompts can condition users to approve requests or trust spoofed login flows, and 1Kosmos links that to control design that assumes human vigilance will hold under pressure. Authentication flows weaken when approval becomes routine and a single mistaken click can open a path to high-value access.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What is MFA Fatigue and How Can Your Business Combat it?”.
Key questions
Q: Why do repeated authentication prompts increase phishing risk?
A: Because the prompt itself becomes familiar, and familiarity lowers scrutiny.
Q: How should security teams reduce the risk of MFA fatigue attacks?
A: Security teams should remove approval-based MFA from high-risk access paths, replace it with cryptographic authentication, and reduce the privileges attached to any successful session.
Q: What breaks when users can be bombarded into approving MFA prompts?
A: The control breaks when approval is treated as proof of intent.
Practitioner guidance
- Reduce repetitive MFA prompts Review where users are forced through repeated approvals for the same session or low-risk activity, then remove avoidable challenge loops.
- Adopt risk-based step-up authentication Trigger extra verification only when device, location, behaviour, or transaction risk changes enough to justify it.
- Harden login-page validation Make users verify the domain and request origin before entering credentials, especially when the flow is unexpected or duplicated.
Bottom line: MFA fatigue is a control-design problem because repeated prompts can condition users to approve requests without careful review.
Glossary terms: MFA Fatigue, Risk-Based Authentication, Passwordless Authentication, Adaptive Authentication
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 6:47 am
Repetitive authentication is now a control-quality problem, not a UX nuisance. When users are asked to approve too many similar challenges, the security meaning of each prompt erodes. That is especially dangerous in human IAM programmes that still treat user attention as a dependable control layer. The practical conclusion is that authentication frequency itself must be governed as part of access design.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations replace MFA with passwordless authentication?
A: Organisations should not treat this as a simple replacement question. MFA is still useful where passwordless is not yet available, but passwordless raises the security baseline by removing the password as the primary failure point. The right path is to use MFA as a bridge and passwordless as the destination.
👉 Read our full editorial: MFA fatigue exposes the weakness in repetitive authentication flows