Article summary: MFA fatigue attacks flood users with approval prompts until someone taps “approve” out of frustration or distraction. Switching from simple push approvals to number matching breaks that pattern by requiring a deliberate code entry for each login. This reduces accidental approvals and makes account takeovers much harder to trigger with prompt spam.
Your employee’s phone starts buzzing. A login approval request appears from your company’s security system. They don’t remember trying to sign in, but they’re busy, and the prompts keep coming. Eventually, they tap “approve” just to make it stop.
That’s the entire attack.
Multi-factor authentication (MFA) fatigue is a technique where an attacker floods a user with repeated login approval requests, counting on frustration or confusion to get one accepted. It’s simple, and it works.
Moving to phishing-resistant authentication methods is the right long-term move, but the fastest improvement most businesses can make is changing how MFA prompts are designed.
By the time an MFA fatigue attack begins, the attacker has the victim’s username and password, typically from a phishing email or a previous data breach. The only remaining obstacle is a single tap on the employee’s phone.
So, they send approval requests. Repeatedly. Sometimes dozens in a row.
The employee either approves one to stop the notifications or calls IT to report the problem. If they approve, the attacker is in. If they call IT, the attack has still consumed time and created confusion.
A push notification that offers only “Approve” or “Deny” gives the user no context. There’s no location, no device name, no code to verify. The user is being asked to make a security decision without any information.
CISA has issued specific guidance on this weakness, strongly recommending that organizations move away from simple approval prompts toward methods that require active participation from the user.
Number matching adds one step that breaks the fatigue attack entirely.
When a user logs in, a two- or three-digit number appears on the login screen. The MFA app on their phone then asks them to type that same number to approve the request. They cannot approve without seeing and entering the correct code.
Material Security’s analysis of MFA fatigue attacks explains why this works.
An attacker spamming approval requests no longer succeeds through repetition alone. Each attempt would require presenting the correct number to the user, which they can’t do. The approval process shifts from passive to active.
The other benefit is awareness. A user who has to consciously type a code is engaged with what they are approving. An employee who sees an unexpected number prompt and has no active login in progress knows something is wrong.
Number matching is a configuration setting, not a separate product purchase.
Microsoft Authenticator has had number matching available since 2022 and has made it the default in more recent versions. Duo Security supports it across its plans. Google Workspace uses a similar mechanism in its security keys and advanced login options.
Check your current MFA app settings. If the approval screen shows only "Approve" and "Deny" with no code to enter, number matching is not active. Your IT administrator can enable it in the authentication platform’s admin console.
This is a quick configuration change that reduces a specific attack path without adding friction for users during normal logins.
Most enterprise authentication platforms allow administrators to cap the number of MFA prompts generated per login attempt within a defined time window.
Setting a limit of five or six prompts per hour and automatically blocking further attempts above that threshold stops the volume-based side of the attack, regardless of whether number matching is enabled.
Displaying the device name, geographic location, and timestamp of each login request inside the notification gives users the information they need to make a real decision.
Designing security workflows around how people actually behave means giving them the context to act correctly, rather than asking them to make decisions in a vacuum.
An employee who sees "New York, 3:14 AM, from a device you have never used" is not going to approve that request.
Already Have MFA? Make Sure It Prevents MFA Fatigue Attacks
The fix for MFA fatigue attacks does not require new software. It requires a configuration review of what you already have. Number matching is available in most major authentication platforms and can be enabled in an afternoon.
For help reviewing your current MFA setup or applying these changes across your organization, contact Vudu Consulting at www.vuduconsulting.com/get-started or email contact@vuduconsulting.com.
An MFA (multi-factor authentication) fatigue attack happens when an attacker who already has a user’s credentials repeatedly sends login approval requests to that person’s phone. The goal is to get the user to approve one out of frustration or confusion. The attack does not require any technical exploitation of the authentication system itself.
Number matching requires a user to enter a code shown on their login screen into their authentication app before a request is approved. This replaces a passive "Approve or Deny" button with an active confirmation step. An attacker spamming requests cannot succeed without showing the user the correct code.
Open your MFA authentication app and look at what an approval prompt shows. If it displays a number that you must type to confirm, number matching is active. If it shows only "Approve" and "Deny" with no code entry, it is not active. Your IT administrator can enable it in your authentication platform’s admin console.
Yes, strongly. MFA prevents a large range of attacks that simple passwords cannot. MFA fatigue attacks require the attacker to already have your credentials, which is itself a significant barrier. Number matching closes the specific gap that fatigue attacks exploit while keeping all the other protections MFA provides intact.
