What is push bombing (MFA fatigue) and how do you stop it?

Push bombing, also called MFA fatigue, is when an attacker who already has someone’s password triggers sign-in prompts over and over until the person taps Approve to make them stop. We have seen it at our clients. The multi-factor authentication keeps working exactly as designed. The target is the person holding the phone.

It often lands at an awkward hour. A phone starts buzzing late on a Sunday night: Deny, Deny, Deny, and after a dozen prompts a tired thumb hits Approve. A stranger now has that Microsoft 365 mailbox, and its owner has no idea anything happened.

How a push bombing attack unfolds

1. The attacker gets the password first, from a phishing page that looked like a Microsoft 365 sign-in, infostealer malware on a home computer, a password reused from an old breach, or a criminal marketplace.
2. They try to sign in again and again. Each attempt sends the real user a new approval prompt.
3. They time it for late at night or early in the morning, when people are tired and less careful.
4. Some add a phone call or text pretending to be IT support: “We’re fixing your account, just approve the next prompt.”
5. One approval is enough. The attacker is in, and can read mail, set up forwarding rules and send messages as the user.

A prompt you didn’t start means your password is already out there. Treat it as an alarm.

The Uber breach, step by step

Uber’s own security update laid out how its September 2022 breach began. Uber said the attacker likely bought a contractor’s corporate password on the dark web after the contractor’s personal device was infected with malware. The attacker then tried to log in repeatedly, and each attempt sent the contractor a two-factor approval request, which at first blocked access.

In Uber’s words: “Eventually, however, the contractor accepted one, and the attacker successfully logged in.”

Two lessons carry over to any office. The password leaked from a personal device the company didn’t control, and MFA held right up until a person approved a prompt they shouldn’t have. Closing that gap takes better settings and one clear rule for staff.

Settings that stop push bombing

CISA describes number matching as one of the best interim steps for organizations that can’t yet move to phishing-resistant MFA. That matches how we set up our clients: admin accounts use phishing-resistant sign-in such as FIDO2 security keys or passkeys, and everyone else uses app approvals with number matching. Start your own move with admins, owners and anyone who moves money or handles sensitive records. Our post on switching from passwords to passkeys covers the basics.

The five-step routine for staff

Give your team a short written routine and practice it in security awareness training. When an unexpected prompt shows up:

1. Don’t approve it, no matter how many arrive or what time it is.
2. Report it, using the Report suspicious activity option if your admin has turned it on.
3. Call IT on a number you already know, never one from a text or from someone who called you.
4. Change the password from a trusted device.
5. Speak up right away if you approved one by mistake. Saying so in five minutes is far better than finding out in five weeks.

A one-page sheet people remember beats a long policy nobody reads. Our post on app fatigue explains why people start tapping through prompts in the first place.

Cut off the password supply

Push bombing only works after the attacker has the password. A business password manager gives every account a long, unique password. Dark web monitoring tells you when company credentials show up in a breach dump. Keeping personal, unmanaged devices away from company data closes the door Uber left open, and single sign-on means fewer prompts, so an odd one stands out. Our guide to strong passwords and authentication covers password policy.

For businesses with compliance requirements such as medical practices, accounting firms, law offices and nonprofits, a hijacked mailbox can turn into a breach investigation with notification duties. Our email sign-in monitoring has caught real takeover attempts at our clients, and when it flags one, we contain the account within the hour. If an attacker does reach a device, the 24/7 security operations center behind every client can isolate it.

Not sure whether number matching is on, or who in your office still signs in with a text code? Book a 15-minute call and we’ll look at your Microsoft 365 sign-in settings together, the same review our cybersecurity services start from.

Related reading: How to implement Zero Trust security in a small business, What is access management? 6 reasons it’s critical for cybersecurity and BYOD policy guide: How to secure personal devices at work.

Frequently asked questions

What is MFA fatigue?

MFA fatigue, also called push bombing, is an attack where someone who already has a user’s password triggers sign-in prompts over and over until the user taps Approve to make them stop. MFA bombing and prompt bombing are other names for the same attack.

How do you prevent an MFA fatigue attack?

Turn on number matching, so a blind tap on a prompt fails, and move admins and anyone who handles money or sensitive records to phishing-resistant sign-in such as passkeys or FIDO2 security keys. Give staff one rule: never approve a sign-in you didn’t start, and report it right away. A business password manager and dark web monitoring cut off the stolen passwords the attack depends on.

Why is MFA fatigue an effective attack method?

It targets the person holding the phone. MFA keeps working as designed until someone approves a prompt, and attackers time the prompts for late at night or early morning, when people are tired. Some also call pretending to be IT support and ask the user to approve the next one, and one approval is enough to get into the mailbox.