Most banks, social media platforms, and business tools now require multi-factor authentication (MFA) as a standard security measure. Since the majority of breaches are the result of leaked credentials, implementing MFA is a simple step to make it harder for cybercriminals to gain access. However, that security practice itself is now under threat from criminal exploitation due to MFA fatigue.
Picture the scene: it’s late, you’re urgently trying to finish a report for the board and suddenly your phone starts alerting. You see a notification to approve access to a database you regularly use. You know you didn’t try to log on, but you’re busy, so you ignore it. The alert goes off again, then again, and then again. You just want to get on with your work. You know you were in the database earlier, so you just accept the request and move on. The next day you experience the cold realisation that your account has been hacked and that you let the attackers in. This is a nightmare scenario for anyone – no one wants to feel like the weak link in their organization – but this is how criminals are banking on you acting.
What is MFA fatigue?
MFA fatigue occurs when users are overwhelmed by push notifications sent to their devices and blindly accept the request without considering whether it’s genuine. Attackers exploit this fatigue with ‘MFA bombing’, whereby they send repeated MFA prompts to trick victims into granting them access to accounts. This attack exploits human psychology rather than technical vulnerabilities; attackers first obtain your username and password through methods like phishing or buying leaked credentials on the Dark Web. Once they have login details, they use automated tools to trigger a flood of MFA approval requests to their target’s phone or other devices.
The constant barrage of notifications makes people more likely to accidentally approve a fraudulent request just to stop the prompts. In some sophisticated attacks, attackers may also call or message their targets, pretending to be IT support to pressure them into approving the login.
How phishing-resistant MFA can combat MFA fatigue
MFA is still one of the most reliable methods available for authentication, but how do we prevent it from being abused? The answer may be using phishing-resistant MFA. This is an advanced security method that uses cryptography to stop attackers from stealing or intercepting login credentials, even if they trick someone into entering them on a fake website. Phishing-resistant MFA moves beyond traditional, phishable methods like SMS codes or push notifications that require user-initiated approvals. Instead, authentication happens automatically and cryptographically between the user’s device and the legitimate service, so attackers cannot overwhelm users with prompts or trick them into tapping ‘approve’.
There are three main options for phishing-resistant MFA:
FIDO2 cryptographic passkeys mean that the private key stays securely on your device, while the public key is registered with the service. Because these cryptographic keys are bound to the legitimate website or app domain, even if a user is tricked by a fake login page, their device will not complete the authentication because the domain does not match the one the passkey was created for.
PIV/CAC smart cards, typically used by governments, use public key infrastructure (PKI) in a physical smart card that stores a cryptographic certificate. You insert the card into a reader and enter a PIN to authenticate. By using cryptographic certificates stored on the physical card to authenticate directly with the legitimate system, credentials are never typed or transmitted in a way that can be intercepted or stolen by a fake or malicious website.
Certificate-based authentication also uses PKI to install a digital certificate directly on a device (like a laptop or smartphone) that presents this certificate to the service to prove its identity cryptographically. This method can eliminate passwords and ensures that authentication only occurs with the correct, verified domain.
Target the human problem
Technological solutions are all very well, but in most cases attackers are exploiting weaknesses in human psychology to achieve their ends. It is crucial that organizations bring their people along with them when it comes to security and provide the training and tools that they need to keep themselves safe. If you make security controls like MFA simple and frictionless to use, staff and users are more likely to make security-conscious choices. Organizations can simplify things for their staff and security teams by implementing the principle of least privilege, which assigns conditional access policies to users to ensure that they only get the access they are configured to.
Another additional protection is to leverage anomaly detection to identify anomalous logins by looking at metrics such as location, device authenticating, and time of day to determine if the authentication request is normal or abnormal. If abnormal, you can block the request and notify administrators.
These tactics should increase security while making the authentication experience more efficient.
How users can avoid MFA fatigue
In addition to phishing-resistant MFA and the technological controls that organizations can put in place, users themselves can take steps to prevent MFA fatigue. For example, switching to one-time passcodes (OTP) from authenticator apps will make them less susceptible to bombing than ‘Approve/Deny’ push notifications. Using the strongest authentication methods available, such as FIDO2 security keys or biometrics (fingerprint or facial recognition), will also make them harder for attackers to bypass.
Configuring systems to automatically lock an account or require manual administrator intervention after a certain number of failed MFA attempts, using strong, unique passwords, and a password manager are also important measures.
Since MFA bombing requires your password first, strong passwords are a critical first line of defence. It is also important to only approve login requests that you initiated yourself. If you receive an unexpected prompt, deny it and report it to your IT department immediately.
MFA remains one of the most effective defences against attackers seeking to leverage stolen credentials to log into systems. However, organizations must remain vigilant as threat actors continue to explore ways to circumvent protections, often exploiting human behaviour to their advantage. For organizations implementing MFA, it is important to ensure that it is frictionless and fits the user experience so it becomes part of a wider security awareness strategy rather than something users accept and ignore.
The author
Michael Downs, VP at SecurEnvoy.
