Topic starter
23/03/2026 2:04 pm
TL;DR: MFA prompt bombing turns repeated push notifications into a social engineering path to account takeover, succeeding through persistence, user fatigue, and stolen credentials rather than cryptographic failure, according to Ping Identity. The lesson is that push MFA without number matching, context, and risk scoring leaves approval itself as the weak link.
Editorial analysis by NHI Mgmt Group, based on content published by Ping Identity: “How to Detect & Prevent MFA Prompt Fatigue Attacks”.
Key questions
Q: What breaks when users can be bombarded into approving MFA prompts?
A: The control breaks when approval is treated as proof of intent.
Q: Why do stolen credentials make MFA bombing more effective than password theft alone?
A: Stolen credentials give attackers a valid starting point, which means the MFA prompt appears to come from a real login attempt.
Q: How should security teams reduce the risk of MFA fatigue attacks?
A: Security teams should remove approval-based MFA from high-risk access paths, replace it with cryptographic authentication, and reduce the privileges attached to any successful session.
Practitioner guidance
- Limit repeated push prompts Set short-window attempt thresholds so a single account cannot be bombarded with endless approvals, and alert when retries exceed the configured ceiling.
- Add contextual prompt details Include device, location, timestamp and other session context in the authentication challenge so users can distinguish a legitimate login from an attack.
- Require number matching for push approval Use number matching or equivalent active verification so a user must intentionally confirm the login event instead of tapping approve by habit.
Bottom line: MFA prompt fatigue attacks succeed by converting repeated notifications into a social engineering path to account takeover.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 2:16 am
Push approval has become an abuseable trust decision, not just an authentication factor. Prompt fatigue attacks succeed because the control boundary sits at the user’s thumb, not in the protocol itself. Once approval can be elicited through repetition, MFA no longer behaves like a hard gate; it becomes a persuasion channel. Practitioners should treat approval behavior as a governed control surface.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations move from push MFA to phishing-resistant authenticators?
A: Yes, when users protect sensitive applications or are likely to face targeted social engineering. Phishing-resistant authenticators reduce dependence on user reaction during the authentication event, which is exactly where push fatigue attacks succeed. The goal is to remove the attacker’s ability to turn repeated prompts into a usable access path.
👉 Read our full editorial: MFA prompt fatigue attacks expose the limits of push approval