Topic starter
10/07/2026 9:19 pm
TL;DR: Push fatigue attacks exploit stolen passwords, unlimited MFA retries, and abstract push prompts to trick users into approving sign-ins, according to Authsignal’s analysis of real-world breach patterns and CISA guidance. Number matching helps, but it does not address the deeper architectural issues that make push MFA easy to socially engineer.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “Push authentication best practices, and why number matching alone is not enough”.
Key questions
Q: What breaks when push MFA depends on blind approvals?
A: Push MFA breaks when users are asked to approve requests without enough context to verify the session behind them.
Q: Why does unlimited MFA retry increase push fatigue risk?
A: Unlimited retries let an attacker keep generating prompts until a user gives in or makes a mistake.
Q: How do security teams know whether push MFA is too abstract to trust?
A: Look for prompts that show little more than a generic approve sign-in message, with no meaningful request context, session linkage, or risk signal.
Practitioner guidance
- Turn on number matching where push MFA remains in use Use it as a floor for reducing blind approvals, especially on consumer-facing or high-volume sign-in paths where one-tap approval is too easy to abuse.
- Throttle challenge creation, not just notification delivery Limit repeated MFA challenge issuance for the same identity and escalate persistent denial patterns to security monitoring instead of treating each prompt as independent.
- Bind approvals to the active session Ensure the challenge can be tied to the browser or app session that initiated it so the user can see whether the request is live and expected.
Bottom line: Push fatigue attacks succeed when MFA prompts are repeated, context-poor, and easy to socially engineer, even if the password itself is valid and MFA is enabled.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
Push fatigue is an approval-design failure, not just a user-error problem. The control breaks when authentication treats every prompt as a discrete event rather than part of a session with context. That is why repeated prompts can overwhelm a user even when passwords are correct and MFA is enabled. The practitioner lesson is that push MFA has to be analysed as a workflow, not a button.
A question worth separating out:
Q: When should organisations move beyond push authentication to stronger methods?
A: Organisations should move beyond push as the primary control when the account or action has high blast radius, when users are repeatedly targeted, or when the login flow cannot reliably bind approval to an active session. In those cases, phishing-resistant methods are the safer baseline.
👉 Read our full editorial: Push authentication best practices and MFA fatigue risk