What human factor do MFA fatigue attacks primarily exploit?

Why MFA fatigue works on people, not protocols

mfa fatigue attacks succeed because they target the person behind the approval screen. The attacker is not breaking the authentication method directly, they are wearing down the user’s patience, attention, and willingness to keep rejecting prompts. That makes this a social engineering problem first, with authentication controls as the practical defense.

Repeated push prompts create a pressure pattern that many users eventually treat as an annoyance to clear rather than a security event to investigate. Well-designed MFA should make an unexpected approval hard to give accidentally, and the user experience should support safe refusal instead of reward quick acceptance.

For workforce sign-in flows, see the Workforce Identity Security Guide for the control patterns that reduce push bombing and improve user resistance to repeated prompts.

Why repeated prompts create an opening for account takeover

MFA fatigue becomes dangerous when the attacker already has a valid username and password or another initial foothold, then uses the prompt stream to trigger a careless approval. The access path is often simple, but the consequence is severe: once one approval lands, the attacker can finish sign-in, add persistence, and look for tokens, sessions, or internal tools to abuse.

This is why number matching, phishing-resistant MFA, and prompt rate limiting matter. They reduce the chance that a tired or distracted user can be coerced into approving access without a meaningful second check. A mature defense also watches for repeated denials, because those are often the clearest sign that the attack is underway.

For an attack-pattern perspective, MFA Guide covers how fatigue, relay, and token theft are used to bypass weaker MFA flows, and why phishing-resistant methods are the better control choice.

What defenders should change in the approval flow

The strongest response is to make the approval event more deliberate and more observable. A user should have to confirm something specific, not just tap through a generic notification, and the identity team should be able to see repeated failures, bursts of prompts, and unusual sign-in timing. That combination makes the attack easier to reject and easier to detect.

If your environment still relies on push-based approvals, treat them as a higher-friction control that needs guardrails. Use rate limits, alert on prompt storms, and make sure help desk and security teams know how to distinguish a frustrated user from an active adversary campaign. If the user experience is tuned only for convenience, it usually becomes a better target for fatigue attacks.

For a more complete rollout path, Passwordless and Passkeys Guide explains why passkeys and FIDO2 reduce the room for prompt-based coercion and improve recovery design.

Risk and Threat Considerations

MFA fatigue is risky because it turns the user into the last weak link in a control that otherwise looks strong on paper. Once attackers can keep prompting, they are trying to induce a single mistaken approval, which can convert a denied login attempt into full account access.

Failure mechanism: The attacker uses prompt spam and time pressure to create frustration, confusion, or habituation, then waits for one approval that bypasses the intended second factor.

Impact: A successful approval can lead to mailbox, SaaS, VPN, or admin account compromise, followed by session theft, privilege escalation, or wider internal access if the account has broad reach.

Practitioner Guidance

What to verify: Confirm that your MFA system can distinguish repeated denials from normal use, and that security monitoring actually alerts on prompt bursts rather than treating them as routine noise. If users can receive unlimited prompts, assume the control is easier to wear down than to defeat.

Decision rule: If the factor can be approved with a single tap, pair it with stronger anti-fatigue protections or move to phishing-resistant MFA. If the user experience depends on speed more than certainty, the control is too easy to exploit.

Practitioner takeaway: MFA fatigue is not mainly about defeating MFA technology, it is about defeating user restraint, so the best defenses make approval deliberate, bounded, and visible.

Related resources from NHI Mgmt Group

• How should security teams reduce the risk of MFA fatigue attacks?
• Why do MFA fatigue attacks still work in mature IAM programmes?
• Why do MFA fatigue attacks still work when MFA is already deployed?
• Why do MFA fatigue attacks work so well in modern IAM programmes?