Click fatigue is the tendency for users to approve prompts, alerts, or verification requests without careful review after repeated interruptions. In identity and security operations, this creates a control gap where users may accept MFA prompts, consent requests, or access approvals reflexively, increasing risk of unauthorized access and social engineering.
What Click Fatigue Is
Click fatigue is not a technical failure in the authenticator itself, but a human reliability problem in the approval path. It appears when repeated prompts train users to treat security requests as routine, which weakens the control value of MFA push approvals, consent dialogs, and access confirmations.
Why It Becomes a Security Problem
The danger is that friction and interruption can turn a protection step into a reflex. Once users begin approving requests automatically, the environment is easier to abuse through MFA prompt bombing, consent phishing, and social engineering that relies on speed, distraction, or habituation rather than exploiting the underlying product.
That makes click fatigue especially relevant in identity workflows where the user’s judgment is the last barrier before access is granted. It is often the difference between a challenge that genuinely verifies intent and a control that is present in name only.
Where Click Fatigue Shows Up
This pattern is most visible in repeated push notifications, recurring verification prompts, consent prompts for applications, and approval flows that appear during busy work periods. It is also common where users are asked to approve access under time pressure or where the same request appears so frequently that it starts to blend into background noise.
Security teams should treat the repeated prompt itself as part of the user experience risk. If the process creates constant interruption, users may start making decisions on familiarity rather than on context, sender, device, or transaction legitimacy.
How Organisations Reduce It
The best mitigation is to reduce reliance on repeated, low-context approval prompts and replace them with stronger, less repetitive verification paths where possible. Organisations should prefer controls that better distinguish legitimate intent from background noise, and they should tune approval workflows so they do not invite habitual acceptance.
Clear user education helps, but design matters more than awareness alone. If the control demands frequent micro-decisions, the control design itself may be generating the very behaviour it is supposed to prevent.
Risk and Threat Considerations
Click fatigue matters because attackers often do not need to defeat the authentication factor directly, they only need a user to approve the wrong request. Repeated prompts create predictable human error conditions that can be exploited for account takeover, unauthorized access, and malicious consent.
Failure mechanism: The user becomes desensitised by repetition, then approves an unexpected or malicious request without checking the context, source, or timing.
Impact: A compromised approval can open the door to session theft, lateral movement, consent abuse, or persistence through trusted access paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Click fatigue weakens the practical use of recurring authentication prompts and approvals. |
| IA-2 — Identification and Authentication (Organizational Users) | The term concerns how users complete authentication and approval steps for access. | |
| AC-7 — Unsuccessful Logon Attempts | Repeated prompt abuse and verification spam are closely related to attempt-limit and friction controls. | |
| Recommendation — Tune authenticator and prompt lifecycle controls to reduce repetitive approvals and discourage reflexive acceptance. Require stronger user authentication flows that reduce overreliance on repeated push approvals. Apply attempt-limiting and lockout-style controls where repeated challenge abuse is occurring. | ||
| OWASP ASVS | V6 — Authentication | The term concerns weaknesses in how users complete authentication and approval during login or step-up checks. |
| V7 — Session Management | Reflexive approval can expose or extend active sessions after weak verification. | |
| Recommendation — Strengthen authentication flows so a user approval is not the sole meaningful security decision. Bind session elevation to clearer reauthentication and stricter session handling. | ||
Practitioner Guidance
Why practitioners should care: Click fatigue is a control-quality problem, not just a training problem. If approval prompts are too frequent or too ambiguous, the organisation has effectively made human reflex part of the security perimeter.
What to watch for: Look for repeated approvals from the same users, short response times on prompts, and patterns that suggest users are accepting requests without checking device, location, or business context. Those are signals that the workflow is being normalised into noise.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org