Push Notification Bombing

How Push Notification Bombing Works

Push notification bombing is a social engineering pressure tactic, not a technical exploit. The attacker’s goal is to overwhelm the target with repeated prompts until the person approves one out of annoyance, confusion, or urgency.

This tactic is effective because many approval-based MFA flows still rely on a human decision at the moment of authentication. When the same prompt appears again and again, the user may start treating it as routine rather than suspicious.

Why It Is Dangerous

The danger is not the notification stream itself, but the false sense of legitimacy it creates. A single mistaken tap can convert a nuisance event into account compromise, session theft, or an attacker’s foothold into email, VPN, SaaS, or admin portals.

It is especially risky when organisations use push-based MFA without stronger anti-fatigue controls. As MFA Fatigue and Bypass Guide explains, the underlying weakness is that repeated approvals can be manipulated into an unintended consent.

Attackers also benefit from timing. A burst of prompts often arrives when the user is busy, distracted, or already expecting a legitimate sign-in, which increases the chance of a reflexive approval.

Where It Fits in Authentication Security

Push notification bombing sits in the broader class of authentication abuse. It targets the moment where identity proofing has already happened, but the second factor still depends on human judgment, so the attack is really about defeating the approval step rather than breaking cryptography.

That is why number matching, prompt binding, and approval limits matter. They reduce the chance that a user can simply accept a prompt without understanding what request is being approved, and they make repeated prompt generation harder to turn into a successful bypass.

For organisations comparing MFA methods, this is one reason phishing-resistant approaches deserve priority. The MFA Guide places push-based approval in context alongside stronger options such as passkeys and security keys.

Recognising the Pattern and Responding Well

A burst of unexpected prompts should be treated as an active sign of attempted account takeover. The pattern often means someone has a valid username and password, and is now trying to force a mistaken approval or wear down the target through persistence.

After a suspected bombing event, organisations should review whether any prompt was approved, whether the sign-in reached a new device or location, and whether the account was used to access mail, documents, or admin consoles. A prompt flood is often the first visible symptom of a broader compromise attempt.

Well-designed response also depends on user education. As Usable Security and Human Factors Guide notes, fatigue and warning overload can make even good controls fail if the interface encourages reflex instead of recognition.

Risk and Threat Considerations

Push notification bombing is dangerous because it weaponises attention, routine, and interruption. The attacker does not need to defeat the MFA system directly, only to exploit the chance that a tired or distracted user will approve a fraudulent request.

Failure mechanism: The repeated prompts create fatigue and normalise the event, so the target may approve a sign-in without verifying that it was initiated by them.

Impact: A successful approval can hand an attacker access to the protected account, enabling mailbox compromise, session theft, downstream impersonation, or movement into other connected services.

Practitioner Guidance

Why practitioners should care: Push notification bombing is a control-quality issue, not just a user-awareness issue. If approval prompts can be spammed at scale, the MFA method is allowing the attacker to pressure the human rather than proving intent strongly enough.

Governance implication: Security teams should treat prompt fatigue as a design and policy problem, with explicit rules for prompt limits, user reporting, and stronger authentication paths for sensitive access.

Practitioner takeaway: The best defence is to reduce reliance on blind approval, because the more a prompt can be gamed by repetition, the less trust it deserves as an authentication signal.

Related resources from NHI Mgmt Group

• What do organisations get wrong about push notification MFA?
• What breaks when push-based MFA is exposed to repeated notification attacks?
• Why do push notification approvals create a persistent authentication risk for organisations?
• Why does push bombing create account takeover risk even when MFA is enabled?