MFA stops most credential attacks - but not all MFA is equal. MFA fatigue (push bombing) defeats the weakest kind.
The attack
The attacker already has the password. They trigger login after login, spamming the victim with "Approve?" push notifications - often at 3am - until the user taps Approve just to make it stop. No malware, no phishing page. It works because simple push MFA asks a yes/no question with no context.
Detect it
- A burst of MFA push requests for one account in a short window.
- Pushes from an unusual location/IP while the user is elsewhere.
- An approval immediately followed by activity from a new device.
Stop it for good
- Number matching - the user must type a code shown on the login screen, so they can't blind-approve.
- Phishing-resistant MFA (FIDO2 / passkeys) - the credential is bound to the origin, so it can't be phished or replayed, and there's no prompt to spam.
- Rate-limit prompts and alert on repeated denials.
If you can, move high-value accounts to FIDO2 - it removes the human "Approve" decision that push bombing exploits entirely.