Topic starter
12/06/2026 10:21 pm
TL;DR: Repeated breaches tied to MFA fatigue, phishing, and social engineering show that mobile push approval is still easy to bypass, while phishing-resistant MFA uses asymmetric cryptography to make approval requests far harder to steal or manipulate, according to Axiad. The real issue is not adding another login factor but replacing trust assumptions that depend on user response under pressure.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Identity is the Key to SaaS Security, and You Need a Better Lock”.
Key questions
Q: What breaks when organisations rely on mobile-based MFA in environments where phones are prohibited?
A: The access model breaks at the point of login, forcing teams into exceptions, workarounds, or weaker backup methods.
Q: Why do phishing-resistant MFA methods reduce account takeover risk more than codes or SMS?
A: They bind the credential to the legitimate domain, so a fake login page cannot capture a reusable secret.
Q: What are the warning signs that MFA fatigue is in progress?
A: Look for many MFA requests in a short time, repeated denials or cancellations, unusual access geography, and a successful approval after a burst of failures.
Practitioner guidance
- Migrate high-risk sign-ins to phishing-resistant MFA Replace push approval on privileged, administrative, and remote access paths with FIDO/WebAuthn or PKI-based methods that do not rely on a simple approve or deny response.
- Map every authentication path, not just the main app login Inventory devices, operating systems, remote access channels, and application-specific sign-ins to find where push, OTP, or other approval-based flows still exist.
- Reduce the value of MFA prompts as an attack surface Tune help desk procedures, user guidance, and alerting so repeated prompts are treated as suspicious behaviour rather than a nuisance to be cleared.
Bottom line: Push-based MFA can be bypassed when attackers exploit human fatigue or impersonation to win an approval prompt.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 1:03 am
Phishing-resistant MFA is really a trust-assumption fix, not a factor-count upgrade. Mobile push and similar approval-based methods still assume the user can safely judge a request at the moment it arrives. That assumption fails under fatigue, pretexting, and repeated interruption. The practitioner conclusion is that MFA strength depends on whether the factor resists manipulation, not on how many factors are present.
Approval-based MFA is now a governance problem, not just an authentication problem. If a sign-in flow can be exhausted, coerced, or socially engineered, the control is only as good as the user under pressure. Identity programmes should therefore measure how much of their access estate still depends on human response instead of cryptographic proof.
A question worth separating out:
Q: How should organisations phase out legacy MFA for sensitive access?
A: Start with privileged users, supplier access, and systems tied to regulated or sensitive data. Replace SMS and push-based approval with phishing-resistant methods such as FIDO2/WebAuthn or PIV/CAC, then update access policies so the stronger method becomes the default for high-risk accounts.
👉 Read our full editorial: Phishing-resistant MFA is the control gap identity teams still miss
This post was modified 6 days ago by NHI Mgmt Group