MFA Fatigue.

What is MFA fatigue?

MITRE tracks this under the technique name MFA request generation. It says adversaries attempt to bypass multi-factor authentication by generating MFA requests to users. MITRE explains that when an attacker has credentials for a valid account, services that send push notifications automatically can be abused to produce those requests. It names “MFA fatigue” as the tactic of repeatedly sending notifications until the user accepts one out of frustration.

How does MFA fatigue work?

The attacker already has a username and password. Each login attempt makes the service send a prompt to the real user’s phone or app. The attacker hopes the user will tap approve just to make the prompts stop, or without checking. A simple illustration: a user sees many unexpected approval requests in a row and accepts one. That single approval completes the attacker’s login.

Why does it matter?

MFA is meant to protect an account even when a password is stolen. CISA says strong passwords are no longer enough on their own and that MFA is a simple, effective step that can block many common attacks. MFA fatigue shows how an approval step can be turned against the user. The weak point is the human decision to approve, not the password.

How can you detect and reduce it?

MITRE lists these mitigations:

• Enable account restrictions to prevent login attempts from suspicious locations, or when the source of the attempt does not match the location of the MFA device.
• Limit the maximum number of MFA request prompts that can be sent to users in a period of time.
• Train users to accept only prompts for logins they started, and to review the source location of the login attempt.

MITRE also notes that attackers can bombard users with push notifications, SMS messages and phone calls, and can abuse automatic push notifications when they are configured for self-service password reset.

CISA ranks security keys as the strongest option because they give the best phishing resistance, with authenticator apps that use number matching next. It says text or email codes provide the weakest protection.

For detection, MITRE points to excessive or anomalous MFA push notifications or token requests, especially when login attempts come from unusual IP addresses or locations.

Is MFA fatigue the same as phishing?

No. In phishing, an attacker tricks a user into giving up information. In MFA fatigue, the attacker already holds the credentials and pressures the user into approving a real prompt. Both rely on persuading a person, so they are related to social engineering.

Is MFA fatigue the same as MFA bypass?

It is one way to bypass MFA. MITRE describes it as an attempt to get around MFA by making the user approve. Other bypass methods exist and are not covered here.

Related terms

See also multi-factor authentication, social engineering and credential theft.

See also

• SMS bombing

Sources

• MITRE ATT&CK: MITRE describes MFA request generation including MFA fatigue, with mitigations and detection analytics.
• CISA: CISA says to aim for phishing-resistant MFA, lists weak or misconfigured MFA as exploited, and ranks security keys and number-matching apps.