Your phone vibrates.
Approve sign-in?
You aren't logging in, so you tap Deny.
Thirty seconds later:
Approve sign-in?
Deny.
Then another.
And another.
Eventually, you're busy, distracted, or simply frustrated by the constant interruptions.
So you tap:
Approve.
And just like that, an attacker who may already possess your password gets the second factor needed to access your account.
This is MFA fatigue, sometimes called push fatigue, push bombing, or MFA bombing.
It's an important reminder that Multi-Factor Authentication is not automatically secure simply because multiple factors are involved.
Attackers have learned something fundamental about cybersecurity:
Sometimes it's easier to attack the person using the security system than the security system itself.
CISA specifically warns that attackers can bombard users with mobile MFA push notifications until someone approves a request accidentally or simply because they are tired of receiving them.
So how should organizations manage MFA fatigue?
The answer isn't eliminating MFA.
It's implementing authentication that requires fewer unnecessary decisions from users—and makes those decisions much harder for attackers to manipulate.
What Is MFA Fatigue?
MFA fatigue occurs when users receive so many authentication requests that they become less attentive to them.
Sometimes the fatigue develops naturally.
An employee might authenticate:
When starting work
When opening email
When connecting to a VPN
When accessing a cloud application
When entering an administrative system
When a session expires
When changing devices
When performing a sensitive transaction
Individually, each authentication request may seem reasonable.
Collectively, they can create an environment where authentication becomes routine.
The user stops asking:
"Is this request legitimate?"
and starts thinking:
"What do I need to tap so I can keep working?"
That's precisely the behavior attackers want.
How Does an MFA Fatigue Attack Work?
A typical attack begins before the victim receives the first push notification.
The attacker may have already obtained the victim's username and password through:
Phishing
Credential-stealing malware
A previous data breach
Password reuse
Social engineering
Credential marketplaces
The attacker attempts to log in.
The password works.
But MFA blocks access.
So the legitimate user's phone receives an authentication request.
The employee rejects it.
The attacker tries again.
Another notification appears.
And again.
Eventually, the attacker is betting on human behavior.
Maybe the employee accidentally taps Approve.
Maybe the employee assumes one of the prompts is associated with something they did earlier.
Maybe the attacker calls pretending to be the IT department and tells the employee:
"We're troubleshooting your account. Please approve the notification you just received."
Or maybe the employee simply becomes frustrated enough to approve the request to make the interruptions stop.
The authentication technology hasn't necessarily been "hacked."
The attacker manipulated the user into completing authentication on the attacker's behalf.
Why Simple Approve/Deny Push MFA Is Vulnerable
Traditional push MFA was designed to make authentication easier.
Instead of:
Receive code → Remember code → Switch application → Enter code
the user simply receives:
Approve / Deny
That's convenient.
But convenience also reduces the amount of intentional participation required from the user.
CISA places simple push-notification MFA without number matching below stronger authentication methods because it remains vulnerable to push bombing and user error. CISA recommends phishing-resistant MFA as the preferred approach.
The weakness isn't necessarily the presence of a second factor.
It's the fact that the security decision may eventually become little more than:
Tap the button.
And once authentication becomes habitual, attackers have an opportunity to exploit that habit.
MFA Fatigue Isn't Just an Employee Problem
It's easy to blame users.
"They should have known better."
That's not a particularly useful security strategy.
If an authentication system sends employees dozens of repetitive prompts and then relies on those employees to carefully evaluate every one, the organization has created a predictable human vulnerability.
People are:
Busy
Distracted
Multitasking
Working under deadlines
Switching between applications
Responding to customers
Attending meetings
Security architecture needs to account for normal human behavior.
A better question is:
Why are we designing authentication that requires users to make so many security decisions in the first place?
Authentication Fatigue Can Happen Without an Attack
There's another side to the problem.
Employees can experience authentication fatigue even when nobody is attacking them.
Imagine an employee who has to authenticate 15 or 20 times during a normal workday.
Eventually, the security process itself becomes frustrating.
That can lead to:
Reduced productivity
User complaints
Help desk calls
Unsafe workarounds
Automatic approval behavior
Resistance to security initiatives
Ironically, an organization can implement more authentication in an effort to improve security and inadvertently train employees to pay less attention to authentication.
More MFA isn't automatically better MFA.
Best Practice #1: Never Approve a Request You Didn't Initiate
For users, this is the most important rule.
If you receive an authentication request and you aren't actively trying to log in:
Do not approve it.
Repeated unexpected MFA requests should be treated as a potential security incident.
Employees should know exactly what their organization wants them to do when this happens.
That might include:
Denying the request
Reporting it to the security team
Contacting the help desk through a known channel
Reviewing recent login activity
Taking appropriate credential-remediation steps
The key is establishing the procedure before an attack occurs.
Best Practice #2: Don't Trust Someone Simply Because They Know About the MFA Prompt
Imagine receiving repeated authentication requests.
Then your phone rings.
The caller says:
"This is IT. We're updating your account. You should see an authentication request. Please approve it."
The timing makes the call seem legitimate.
But the attacker may simply be coordinating social engineering with the login attempt.
Employees should never authenticate merely because someone calls, texts, or emails telling them to approve a request.
Verify IT or security requests using established corporate channels.
Best Practice #3: Use Number Matching Instead of Simple Approval
Number matching improves push authentication.
Instead of receiving:
Approve? Yes / No
the legitimate login screen displays a number.
The authentication application requires the user to correlate that number with the authentication request.
This forces the user to interact with the authentication session they actually initiated.
An attacker repeatedly generating random push notifications can't rely as easily on the employee eventually tapping Approve.
CISA recommends number matching as an interim defense for organizations that cannot immediately move to phishing-resistant MFA.
But there's an important qualification:
Number matching improves push MFA. It doesn't make every push implementation immune to phishing or social engineering.
Best Practice #4: Rate-Limit Push Notifications
Why should an attacker be allowed to send an employee 50 authentication requests?
They shouldn't.
Organizations should limit the rate and total number of authentication prompts that can be generated.
Current NIST guidance recommends reasonable limits on the rate or total number of push notifications sent since the last successful authentication.
That helps turn this:
Approve? Approve? Approve? Approve? Approve?
into:
Something unusual is happening. Stop and investigate.
Security teams should also monitor repeated authentication attempts as potential indicators of compromise.
Best Practice #5: Give Users Meaningful Context—Before They Authenticate
One of the biggest problems with conventional push MFA is how little information the user may receive.
A notification appears:
Approve Sign-In?
Approve | Deny
But approve what?
Was the authentication request generated by something the user just did—or by an attacker who already has the user's credentials?
Identité takes a more contextual approach.
During the authentication process, the user can be presented with multiple pieces of information together on the same screen to help establish whether the request corresponds to an action they actually initiated.
For example, the authentication screen can include:
A Direct Confirmation Message
At the top of the authentication screen, Identité presents the user with a direct question such as:
"Did you request this authentication session?"
That may seem like a small change.
It isn't.
Instead of simply asking the user to press an unexplained Approve button, the message requires the user to consider something specific:
Did I actually initiate this?
If the answer is no, the user immediately has a reason to stop.
A Visual Image
The same authentication experience also presents an image, giving the user another visual element associated with the authentication session.
The user isn't simply looking at an anonymous notification demanding approval.
There is additional context available as part of the authentication experience.
A Three-Digit Verification Number
Identité also incorporates a three-digit number into the authentication interaction.
Rather than reducing authentication to a habitual:
Tap Approve → Continue
the user receives several contextual elements together on the same screen:
The question + The image + The three-digit number
The authentication process is therefore designed to encourage the user to consciously evaluate what is happening.
This is important because MFA fatigue attacks depend on precisely the opposite behavior.
The attacker wants:
See prompt → Tap Approve
Identité's approach encourages:
Look → Confirm → Authenticate
From Approval to Intent
This distinction deserves special attention.
Traditional push authentication often revolves around one concept:
APPROVAL
But approval and intent aren't necessarily the same thing.
A distracted employee can approve something.
A frustrated employee can approve something.
An employee experiencing dozens of authentication prompts can eventually approve something simply to make the notifications disappear.
But asking:
"Did you request this authentication session?"
connects the authentication event directly to the user's intent.
That's a better security question.
The user isn't simply being asked:
"Will you allow this?"
The user is being asked:
"Is this authentication request the result of something YOU actually initiated?"
That changes the nature of the interaction.
Why Context Matters in an MFA Fatigue Attack
Consider the attacker's objective.
They don't necessarily need to break the MFA technology.
They need the legitimate user to complete authentication for them.
A generic approval prompt helps the attacker because it provides very little context.
Now consider an authentication experience presenting:
"Did you request this authentication session?"
along with:
An image
and:
A three-digit verification number
on the same authentication screen.
The employee has more information available before making the security decision.
Instead of treating authentication as a reflex, the process encourages the user to connect the request to an action they knowingly initiated.
This doesn't mean users should become the only line of defense.
Quite the opposite.
Context should complement stronger authentication architecture—not replace it.
And that's where Full Duplex Authentication® becomes particularly important.
Best Practice #6: Reduce Unnecessary Authentication Prompts
One of the best ways to combat MFA fatigue is remarkably simple:
Stop generating unnecessary MFA fatigue in the first place.
If employees are constantly challenged during legitimate work, they become conditioned to respond automatically.
Authentication policies should therefore consider:
Session duration
Device trust
Application sensitivity
User role
Risk level
Transaction sensitivity
Existing authentication state
A routine activity performed by a strongly authenticated employee on a trusted corporate device may not require the same authentication experience as an administrator accessing a highly sensitive system.
The objective shouldn't be:
Maximum number of authentication prompts.
It should be:
Maximum authentication confidence with minimum unnecessary friction.
Best Practice #7: Move Toward Phishing-Resistant Authentication
Number matching is useful.
Context is useful.
Training is useful.
Rate limiting is useful.
But organizations should continue moving toward authentication designed to resist phishing rather than relying entirely on employees to identify every fraudulent authentication attempt.
CISA recommends phishing-resistant MFA as the strongest form of MFA and identifies approaches such as FIDO/WebAuthn and PKI-based authentication as phishing-resistant options.
Why?
Because humans will occasionally make mistakes.
Attackers know that.
Security architecture should know it too.
But There's Another Problem: What If the Website Is Fake?
MFA fatigue highlights a broader weakness in traditional authentication.
Most authentication systems concentrate on one question:
"Is this really the authorized user?"
But suppose the employee is interacting with an imposter website.
The site may look exactly like:
Microsoft 365
A corporate VPN
A bank
A healthcare portal
An internal business application
The attacker can copy:
Logos
Colors
Fonts
Login screens
Corporate branding
A user may initiate authentication willingly because they believe the website is legitimate.
In that situation, the user isn't tired.
They aren't distracted.
They may be doing exactly what they think they're supposed to do.
They're simply authenticating to the wrong destination.
That's why reducing MFA fatigue alone doesn't solve the entire authentication problem.
Authentication Should Work Both Ways
Traditional authentication primarily requires the user to prove identity to the system.
But modern digital trust should address both sides.
The user should establish:
"I am legitimate."
And the destination should establish:
"I am legitimate too."
That is the principle behind Identité's patented Full Duplex Authentication®.
What Is Full Duplex Authentication®?
Full Duplex Authentication® (FDA) is the patented technology powering Identité's PasswordFree® SaaS solution and NoPass™ enterprise PaaS solution.
FDA establishes mutual authentication.
Instead of simply asking whether the user is legitimate, the authentication relationship also requires the legitimate application or website to establish its identity.
Traditional authentication asks:
"Are you really you?"
Full Duplex Authentication® adds:
"Am I really who you intended to connect with?"
That distinction matters enormously in a world of phishing, lookalike domains, and imposter websites.
How Full Duplex Authentication® Changes the MFA Fatigue Conversation
Now put the pieces together.
During an Identité authentication experience, the user can receive contextual information designed to answer:
"Did I initiate this authentication session?"
The image and three-digit number provide additional session context.
The biometric can help establish:
"Am I the authorized user?"
The trusted device participates in establishing:
"Is this the authorized device?"
And Full Duplex Authentication® addresses:
"Is this the legitimate destination?"
This moves authentication beyond a simple:
Approve / Deny
interaction.
Instead, the authentication relationship incorporates:
Intent + Context + Identity + Device Trust + Destination Trust
That's a much broader way to think about authentication security.
The Best MFA Prompt May Be the One You Don't Need
For years, cybersecurity often equated friction with security.
More password complexity.
More frequent password changes.
More codes.
More prompts.
More approvals.
But friction and security aren't the same thing.
Sometimes additional friction improves security.
Sometimes it merely makes employees frustrated.
And sometimes it trains them into precisely the behavior an attacker wants.
The goal should be:
Maximum authentication confidence with minimum unnecessary user interaction.
That is especially important in environments where authentication frequency can directly affect productivity.
Consider Healthcare
Imagine a physician or nurse moving between clinical systems throughout a shift.
They may need rapid access to:
Electronic health records
Medication systems
Diagnostic applications
Clinical workstations
Administrative systems
Security is critical.
But repeatedly interrupting clinicians with ambiguous MFA prompts can create authentication fatigue while interfering with patient care.
Healthcare organizations therefore need authentication that is both:
Strong enough to protect sensitive information
and:
Fast enough to support clinical workflows.
Security and usability cannot be treated as unrelated objectives.
Financial Institutions Face Similar Challenges
Banks have extremely high security requirements.
But employees may also access numerous systems throughout the day.
A financial institution needs to protect:
Customer information
Financial transactions
Administrative systems
Privileged accounts
Internal applications
The answer cannot simply be:
"Send more authentication prompts."
Authentication needs to reflect risk, user role, transaction sensitivity, device trust, and organizational policy.
For highly regulated organizations, control over the authentication infrastructure itself may also matter.
That's one reason Identité provides both SaaS and enterprise deployment options.
PasswordFree® — SaaS Authentication Without Constant Password Dependency
PasswordFree® is Identité's SaaS passwordless authentication solution.
It is designed around:
Passwordless authentication
Patented Full Duplex Authentication®
Mutual authentication
Decentralized biometric verification
Contextual authentication
Reduced authentication friction
Protection against phishing and imposter websites
Emergency PIN Authentication
Secure Backup & Restore
Compatible third-party authentication alternatives
The objective isn't simply to replace one MFA prompt with another.
It's to create a stronger authentication relationship that reduces dependence on passwords and unnecessary user interaction.
NoPass™ — Enterprise Authentication With Greater Control
For organizations requiring deeper enterprise integration and deployment control, NoPass™ is Identité's PaaS solution powered by patented Full Duplex Authentication®.
NoPass™ can be deployed on premises or in the cloud and is designed for environments involving:
Microsoft Active Directory
Microsoft Entra ID
Microsoft 365 / Office 365
Microsoft Azure
This can be particularly important for banks, healthcare organizations, government agencies, and other regulated enterprises.
Financial institutions that prefer to keep sensitive authentication infrastructure within their own controlled environments can deploy NoPass™ on premises.
Biometrics Can Reduce Authentication Friction—But Privacy Matters
Biometric authentication can significantly simplify the user experience.
Instead of:
Password → Push notification → Approve
the user may be able to verify identity using:
Fingerprint or face → Authenticated
But biometric convenience raises an important question:
Where is the biometric information stored?
Identité uses a decentralized authentication architecture designed so biometric information remains on the user's trusted device.
The biometric does not need to be transmitted to Identité, the employer, or a centralized Identité biometric repository for matching.
Your biometric data stays on your device.
This provides an important privacy advantage while reducing the risks associated with creating centralized collections of sensitive biometric information.
What If the Phone Isn't Available?
Reducing authentication fatigue is only useful if the authentication system also addresses business continuity.
Phones get:
Lost
Stolen
Broken
Replaced
Forgotten
Left without power
Identité provides an Emergency PIN Authentication capability that, when permitted by organizational policy, can provide controlled temporary access when the primary device isn't available.
If the device must be replaced, Secure Backup & Restore allows the authentication profile to be backed up according to organizational configuration to approved cloud or corporate-network infrastructure.
The profile can then be restored to a replacement device in less than two minutes.
The objective is simple:
Strong security shouldn't become unnecessary downtime.
Hardware Keys Provide Another Option
Not everyone wants—or is permitted—to use a smartphone.
Some organizations operate in environments where phones are restricted.
Some employees prefer physical authentication devices.
Some privileged users may require stronger authentication.
Identité is compatible with supported third-party hardware authentication options, including security keys such as YubiKey®.
Authentication architecture should accommodate different users and environments rather than forcing everyone into the same workflow.
An MFA Fatigue Management Checklist
Organizations looking to reduce MFA fatigue should focus on technology, policy, and user experience:
Never rely on passwords alone.
Teach users never to approve authentication requests they didn't initiate.
Establish a clear reporting procedure for unexpected MFA prompts.
Replace simple Approve/Deny push authentication with stronger approaches.
Use number matching where push MFA remains necessary.
Ask users explicitly whether they initiated the authentication session.
Provide meaningful visual and numerical authentication context.
Rate-limit repeated authentication requests.
Monitor repeated MFA attempts as possible indicators of compromise.
Reduce unnecessary authentication prompts.
Use risk-appropriate authentication policies instead of challenging everyone constantly.
Prioritize phishing-resistant authentication for high-risk users and systems.
Consider mutual authentication so the destination establishes trust too.
Provide secure recovery methods before devices are lost.
Offer appropriate authentication alternatives for different users and environments.
Measure authentication success by security and usability—not simply by the number of challenges issued.
The Identité Perspective
MFA fatigue teaches us an important cybersecurity lesson.
More authentication isn't necessarily better authentication.
If employees receive so many prompts that authentication becomes an automatic reflex, additional security controls can begin working against their intended purpose.
The answer isn't abandoning MFA.
It's designing authentication around intent, context, and stronger trust.
Instead of simply presenting:
Approve?
Identité can ask:
"Did you request this authentication session?"
The image and three-digit number provide additional context surrounding the authentication event.
The biometric can help establish:
"I am the authorized user."
The trusted device participates in establishing:
"This is the authorized device."
Patented Full Duplex Authentication® establishes:
"This is the legitimate destination."
And Identité's decentralized architecture is designed around another important principle:
"My biometric data stays on my device."
Through PasswordFree® and NoPass™, these capabilities can be combined with passwordless authentication, compatible hardware security keys, Emergency PIN Authentication, Secure Backup & Restore, and flexible enterprise deployment.
Because employees shouldn't have to become professional cybersecurity analysts every time their phones vibrate.
And organizations shouldn't measure authentication security by how many times they can interrupt their employees.
The evolution we should be working toward is:
Approval → Intent
Prompt → Context
User verification → Mutual authentication
Friction → Trust
The goal isn't more authentication.
It's better authentication—strong enough to stop attackers, contextual enough to help users recognize legitimate requests, and simple enough that authorized employees can get back to work.