MFA fatigue works because attackers exploit routine behavior, not just technical weakness. Users become accustomed to repeated prompts and may approve a request to stop the disruption, especially when they are busy or distracted. Once attackers have valid credentials, a stream of notifications can pressure the target into granting access, turning a normal security control into a social engineering channel.
Why MFA Fatigue Works Even When People Understand the Risk
mfa fatigue succeeds because attackers are not trying to defeat the idea of multifactor authentication, they are trying to exploit the human response to repeated interruption. The control is still technically sound, but the user experience creates a pressure point: annoyance, urgency, distraction, and the assumption that a prompt must be legitimate because it keeps appearing.
Once an attacker has a password or other first factor, the second factor can become a persistence mechanism for social engineering. The user is no longer judging a one-time login event, but a stream of requests that can feel like a system problem, a sync issue, or a routine sign-in they need to clear to get back to work.
What the Attacker Is Exploiting in the Approval Flow
The core weakness is behavioral, not cryptographic. Push-based approvals depend on the user recognizing an unexpected prompt and refusing it, but repeated notifications train some users to click through just to restore normality. That is why MFA fatigue is often paired with credential theft, password spraying, or a separate initial compromise that gives the attacker a real reason to keep sending prompts.
The attack also benefits from timing and context. If the target is busy, sleeping, in a meeting, or handling alerts from multiple systems, the prompt starts to look like background noise. In that state, a single mistaken approval can hand the attacker the session they need, especially if the organization allows broad access after a successful multifactor challenge.
Why User Awareness Alone Does Not Stop It
Knowing that MFA is protective is not the same as being able to apply that knowledge under pressure. Fatigue attacks work in the gap between policy understanding and real-world behavior. The user may understand that repeated prompts are suspicious, but the immediate goal becomes relief from interruption, not careful verification of each request.
This is why the strongest defenses reduce ambiguity at the moment of approval. Authentication methods that provide context, number matching, device binding, or phishing-resistant confirmation narrow the chance that a user will approve a request simply because it appears familiar. The less a prompt can be mistaken for routine noise, the less useful it is to an attacker.
Risk and Threat Considerations
MFA fatigue is dangerous because it converts a defensive control into an attacker-controlled attention channel. If the first factor is already compromised, the main failure mode is not bypassing MFA technology, but persuading a legitimate user to authorize access under annoyance, urgency, or confusion.
Failure mechanism: The attacker repeatedly generates prompts until the target accepts one, often after the user has normalized the notifications or wants them to stop.
Impact: A single approval can give the attacker authenticated access to email, SaaS applications, internal tools, and the trust relationships that follow, which can then support data theft, lateral movement, or further impersonation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API2 — Broken Authentication | MFA fatigue abuses the authentication step to obtain access. |
| Recommendation — Use stronger authentication challenges that resist prompt-based approval abuse. | ||
| NIST SP 800-63 | Digital Identity Guidelines | Phishing-resistant and context-aware authenticators directly reduce prompt fatigue abuse. |
| Recommendation — Adopt phishing-resistant authenticators and limit approval-based sign-in flows. | ||
| NIST CSF 2.0 | PR.AA-05 — Manage Access Credentials and Authenticator Requirements | The question centers on how authenticator use fails under repeated approval pressure. |
| Recommendation — Require authenticators that cannot be easily approved under social pressure. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | MFA fatigue attacks target organizational user authentication events. |
| Recommendation — Strengthen user authentication with resistant MFA methods and monitoring. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Repeated approvals can grant unauthorized access through compromised accounts. |
| Recommendation — Restrict access paths and verify all unexpected approval events. | ||
Practitioner Guidance
What to prioritize: Treat repeated push approvals as a sign of compromise, not just user error. The most useful response is to remove the attacker’s ability to continue prompting, then verify whether the approved session, device, or account has already been used beyond the initial sign-in.
What to verify: Confirm that the MFA method provides an explicit challenge the user can distinguish from background noise, and verify that help desk and identity operations know how to respond when a user reports multiple unsolicited prompts. If the process for denying, reporting, and resetting access is unclear, attackers can turn that uncertainty into access.
Practitioner takeaway: MFA fatigue is successful when the organization treats approval as a routine event instead of a security decision; reducing prompt ambiguity and making suspicious approvals operationally visible is what breaks the attack path.
Related resources from NHI Mgmt Group
- Why do SIM swapping attacks succeed even when users have basic password hygiene and MFA?
- Why do MFA spoofing attacks still succeed even when two-factor authentication is enabled?
- Why do phishing attacks still succeed even when people know the warning signs?
- Why do help desk impersonation attacks succeed even when MFA is deployed?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
