TL;DR: If your authenticator app keeps asking you to approve a sign-in you didn’t start, someone almost certainly has your password and is "push bombing" you, hoping you tap Approve to make it stop. It’s how a hacker got into Uber in 2022: after more than an hour of prompts, they messaged the victim on WhatsApp pretending to be IT. Deny every prompt, change that password now, and switch to number matching, a passkey or a security key. Microsoft made number matching mandatory in its Authenticator app from 8 May 2023, and CISA calls phishing-resistant MFA the best defence.
What MFA fatigue is
Two-factor authentication works because a password alone isn’t enough. MFA fatigue (also called push bombing) is how attackers get around it. According to CISA, an attacker who already has your password repeatedly triggers push notifications, hoping you approve one by accident or just to make them stop.
It’s a war of attrition: 2 a.m., twentieth notification, half asleep, thumb hovering over Approve. That’s the moment they’re waiting for.
How it worked against Uber
TechCrunch reported how a hacker linked to the Lapsus$ group got into Uber in September 2022:
- They had a contractor’s password, possibly bought on a dark web marketplace or stolen by password-stealing malware.
- They sent push prompts repeatedly for over an hour.
- Then they messaged the contractor on WhatsApp, claiming to be Uber IT, and said that if he wanted the prompts to stop, he had to accept one.
- He accepted, and the hacker added their own device, giving them ongoing access.
Notice the second half. The prompts wear you down; the fake "IT support" message tells you what to do. Real IT staff will never ask you to approve a prompt you didn’t start.
A prompt means your password is out
CISA notes that MFA is checked after the password, so an unexpected approval request usually means your password is already compromised. Those prompts aren’t just annoying. They’re an alarm.
What to do right now
- Deny every prompt you didn’t start. Never approve "just to see."
- Ignore anyone who contacts you about the prompts, by phone, text or WhatsApp, even if they say they’re IT or the company’s security team.
- Change the password for that account immediately, and anywhere you reused it.
- Check sign-in activity, remove unknown devices and sign out of other sessions (how to log out of all devices).
- If it’s a work account, tell your IT or security team right away.
- Check whether the password leaked in a breach (how).
Settings that stop it
| Fix | How it helps | Where |
|---|---|---|
| Number matching | You must type a number shown on the login screen into your app. An attacker who can’t see your screen can’t approve | Microsoft Authenticator (mandatory since 8 May 2023), Duo, Okta |
| Passkeys | Sign-in is tied to your device and the real website, so there’s nothing to approve remotely | Google, Apple, Microsoft and many others; see setting up passkeys |
| Security keys | Physical keys that can’t be phished; how they work | Most major accounts |
| Unique passwords | One breach doesn’t unlock everything | A password manager |
According to BleepingComputer, Microsoft removed the admin option to turn number matching off and enforced it for all Authenticator push users, calling it "a key security upgrade." CISA’s guidance recommends phishing-resistant MFA as the strongest option and number matching as an interim step.
For businesses
TechCrunch notes that security teams can also cap how many push prompts a user can receive and alert when that limit is hit. Combined with number matching, that turns a push-bombing attempt into an early warning instead of a breach.
Was it a mistake?
Occasionally an old device or app retries a login with a saved password. If prompts arrive in a steady trickle at the same time daily, check your other devices. A sudden burst at odd hours is almost certainly an attack.
Where did they get your password?
Usually from an older breach, a phishing page or password-stealing malware. A free email exposure check shows which breaches your email appears in, which often explains which password was stolen. Then read up on credential stuffing, the attack that reuses those leaked passwords.
Frequently Asked Questions
What is MFA fatigue?
An attack where someone with your password floods you with login approval requests, hoping you tap Approve by mistake or to make them stop.
Why am I getting login approval requests I didn’t make?
Someone probably has your password. Deny the requests and change the password immediately.
Someone from IT messaged me to approve the prompt. Should I?
No. In the 2022 Uber breach, the attacker posed as IT on WhatsApp to get the victim to approve. Contact your IT team through a channel you already know.
What is number matching?
A sign-in method where you type a number shown on the login screen into your authenticator app. Microsoft made it mandatory in Authenticator from 8 May 2023.
What’s the best protection against MFA fatigue?
Phishing-resistant MFA such as passkeys or security keys, plus unique passwords from a password manager.
Sources
- CISA: Implementing number matching in MFA applications
- CISA: Guidance on phishing-resistant and numbers-matching MFA
- TechCrunch: How to fix another Uber breach (Sep 2022)
- BleepingComputer: Microsoft enforces number matching to fight MFA fatigue attacks (May 2023)