MFA fatigue: why "just press Approve" attacks work and how to stop them

Multi-factor authentication blocks most account takeovers. But one simple trick still gets through: if an attacker already has the password, they can trigger login prompts again and again until a tired user taps Approve just to make it stop.

How the attack works

1. The attacker gets a password from a phishing page or an old data breach.
2. They try to sign in, which sends a push notification to the real user's phone.
3. They repeat it, sometimes late at night, sometimes with a fake "IT support" message asking the user to approve.
4. One approval is enough. The attacker is in.

How to stop it

• Number matching: the user must type a number shown on the login screen, so a blind "Approve" no longer works.
• Show context: display the app name and location in the prompt so odd requests stand out.
• Limit prompts: block or alert after several denied requests in a short time.
• Phishing-resistant methods such as security keys or passkeys for admins and high-risk accounts.
• Train people on one rule: if you didn't just try to sign in, deny it and report it.

If someone already approved

Reset the password, sign the account out of all sessions, review recent sign-ins and mailbox rules, and check for new MFA methods the attacker may have added. Then ask what made the request look believable, and fix that too.