MFA Fatigue
MFA fatigue is social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second factor — a confirmation the user has to approve on their phone. So the attacker starts the login over and over, burying the phone in approval requests. The arithmetic is simple: out of irritation, confusion, or the thought that it must be some glitch, the user approves one at some point — and the attacker is through the whole authentication.
Term
description · examples · notesMFA fatigue is social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second factor — a confirmation the user has to approve on their phone. So the attacker starts the login over and over, burying the phone in approval requests. The arithmetic is simple: out of irritation, confusion, or the thought that it must be some glitch, the user approves one at some point — and the attacker is through the whole authentication.
Description
The attacks usually run in the dead of night, three in the morning say, to catch the user half-asleep, or arrive with a fake call and message — "IT here, please approve the request so we can fix a sync problem". The method works only where the user confirms by pressing an Approve button. It does not work where numbers have to be typed from the login screen, nor where hardware keys are in use.
The defense is to replace or supplement the simplified Approve/Deny with a confirmation that requires a generated number to be entered. Safer still is a phishing-resistant factor (FIDO2, passkeys, hardware keys). Alongside that, consecutive requests should be limited, and staff need to know that an avalanche of them usually means somebody has their password. Nothing gets approved; it gets reported. Behind all this, the attack itself means the password has already leaked, so that needs changing too.
Examples
- The Uber breach (2022): the attacker buried an employee in MFA requests until they approved one, and was let into the internal systems.
- A flood of requests at five in the morning, with a message reading "Dear colleague, please approve the request so we can finish the installation. IT team" — that cannot be a legitimate thing.
- MFA with number matching shuts this attack down, because the attacker cannot see the number on the victim's screen and the victim cannot approve blind.
Notes
- It is less a technical breach than social engineering. The cure is not a stronger password but removing the option to approve blind — a number to confirm, or a hardware key.
- An avalanche of MFA requests means the password is already in someone else's hands: nothing should be approved, and it should be changed.
Mentioned in the news
Techniques
carried out with 2Techniques used to carry it out. Select one to open its page.
Defenses
countered by 4How it is defended against. Select one to open its page.