What are the warning signs that MFA fatigue is in progress?

How to recognise MFA fatigue while it is unfolding

mfa fatigue usually looks noisy before it looks successful. Repeated prompts, denials, and cancellations are the core pattern, but practitioners should also watch for timing anomalies, repeated prompts outside normal working patterns, and access attempts from unusual geographies or devices that do not fit the user’s usual profile.

A useful way to interpret the signal is that the attacker is testing whether the user will eventually approve under pressure. The warning signs are therefore behavioural and temporal, not just technical, and they often appear before any account is actually compromised.

Why the approval pattern matters more than a single push

A lone MFA prompt can be benign, but a burst of requests followed by a successful approval is a strong indicator of social-engineering pressure rather than a password or token flaw. That is why defenders should treat the sequence as the unit of analysis: frequency, persistence, and eventual consent together tell you more than any one event.

The same logic applies when the prompt stream is paired with sign-in anomalies such as impossible travel, unfamiliar IP space, or a device that has not been seen in the user’s normal access history. When those signals line up, the issue is no longer just alert noise, it is an active attempt to wear down the user’s judgment.

For broader context on how attackers abuse push-based approvals and weak sign-in workflows, the MFA Guide and Workforce Identity Security Guide show why phishing-resistant MFA and recovery controls matter when the sign-in channel itself becomes the target.

What the pattern usually tells an investigator

Once the warning signs appear, the immediate question is whether the user was merely annoyed or whether the account was already being tested for downstream access. A sustained denial pattern, especially if it ends in one acceptance, can indicate the attacker had valid primary credentials and was waiting for the second factor to be approved.

That is why responders should review the entire access chain, not just the MFA event stream. Correlating repeated prompts with sign-in logs, help desk contact, session creation, and any follow-on privileged activity helps distinguish nuisance activity from the early stage of a real compromise.

Real-world incidents show how this plays out. In Uber breach 2022, Cisco Yanluowang breach 2022, and Twilio 0ktapus breach 2022, the human approval path was part of the attacker’s access strategy, not a side effect of a technical failure.

Risk and Threat Considerations

MFA fatigue is dangerous because it turns a control designed to resist credential theft into a pressure point. If the attacker can generate enough prompts, the defense can fail without malware, exploitation, or a broken cryptographic mechanism, which makes the threat easy to underestimate in noisy environments.

Failure mechanism: The attacker uses valid credentials or an existing sign-in flow to trigger repeated MFA prompts until the user approves, cancels less often, or accepts out of confusion or urgency.

Impact: Once a prompt is approved, the attacker can establish a session, move laterally, access mail or SaaS data, and sometimes reach privileged systems before the compromise is recognised.

Practitioner Guidance

What to verify: Do not stop at the count of prompts. Verify whether the requests came from one source, whether the same user saw repeated prompts across a short window, and whether a successful approval immediately preceded token issuance, new session creation, or privilege use.

What good looks like: The account owner should be able to challenge an unexpected prompt, the SOC should see the full prompt burst in telemetry, and the organisation should be able to correlate the event with device, geolocation, and session history fast enough to contain it before lateral movement begins.

Decision rule: If the prompt burst is paired with an unusual geography, an untrusted device, or a successful approval after repeated denials, treat it as a probable live attack and escalate as an identity incident, not a help desk nuisance.

Practitioner takeaway: MFA fatigue is identified by sequence and pressure, not by a single alert, so the operational priority is to detect prompt storms early and respond before a tired user becomes the attacker’s approval channel.

Related resources from NHI Mgmt Group

• What are the warning signs that MFA is creating too much friction?
• What are the signs that MFA is being undermined by prompt fatigue and repeated approval requests?
• What are the warning signs that a tech support scam is in progress?
• What are the signs that MFA is helping detect a ransomware attempt in progress?