Two-factor login stops most attacks, so criminals have found ways around it. One of the simplest relies on wearing you down. This guide is part of our two-factor login and passkeys guide.
What MFA fatigue is
Some logins ask you to approve a push notification on your phone. In this attack, a criminal who already has your password tries to log in again and again. Your phone buzzes with prompt after prompt, perhaps late at night.
Sometimes they add a call or a message pretending to be IT support: "Sorry for the alerts, please approve the next one to make them stop."
The attack works because of tiredness and annoyance. It takes only one tap.
Why it matters
A prompt that you did not cause means one thing: someone has your password. So this is an emergency, even if you never tap approve.
What to do if it happens
- Tap deny, every time.
- Do not reply to any call or message about the prompts.
- Change the password for that account, from a device you trust.
- Log out of all other sessions.
- Look for changes to your recovery details.
- If it is a work account, report it to your IT team right away.
How to protect yourself
- Use a stronger method. Security keys and passkeys cannot be approved by accident, since there is nothing to tap on a remote request.
- Use number matching if your service offers it.
- Replace any leaked password. Learn how to check if your password has leaked.
- Use unique passwords, so that a leak affects just one account. See credential stuffing.
For small business owners
If you run accounts for others, turn on number matching, limit how many prompts can be sent, and teach staff to report unexpected prompts. Support staff should never ask anyone to approve a prompt.