When MFA Becomes the Vulnerability

Executive Summary

Multi-factor authentication was supposed to be the answer. It still is, mostly. But attackers have adapted, and the new threat is not a technical exploit: it is a behavioral one. Understanding how MFA fatigue attacks work and what to do about them is now a core part of any serious security posture.

Why It Matters

Multi-factor authentication has become a standard recommendation in every cybersecurity framework. The logic is straightforward: even if an attacker steals a password, they cannot get in without the second factor. For years, that held up.

Then the attacks evolved.

MFA fatigue attacks work differently than traditional credential theft. Attackers do obtain a valid username and password, usually through phishing or a prior data breach. But instead of trying to defeat the MFA system technically, they take a simpler approach. They flood the target's phone with authentication requests, one after another, until the person approves one just to make the notifications stop.

This is not theoretical. The Uber breach in 2022 is one of the most widely cited examples. An attacker obtained employee credentials, then bombarded the employee with MFA push notifications late at night. When the employee finally approved the request, the attacker was inside. From there, they moved laterally across internal systems and extracted sensitive data.

The uncomfortable truth is that the vulnerability was not the technology. It was the experience of using the technology under pressure.

How It Impacts Businesses

The business impact of MFA fatigue attacks follows a familiar pattern that tends to move fast once it starts.

An employee approves a fraudulent authentication request. The attacker gains a foothold. Depending on what that employee has access to, the intrusion can spread to internal file shares, email accounts, cloud applications, and customer data within hours.

Companies that rely on cloud-based productivity suites are particularly exposed. If a compromised account has access to email, it can be used to pivot: sending internal phishing messages that look legitimate, approving financial requests, or resetting passwords for other accounts. The initial breach is often just the beginning.

There is also a workforce reality to consider. Most employees do not know what an MFA fatigue attack looks like. They know that approving the notification is normal. They do not necessarily know that receiving dozens of them in rapid succession is a red flag that demands immediate escalation rather than a frustrated tap to approve.

That knowledge gap is where attackers operate.

For more on what a breach can cost once an attacker is inside, see The Real Cost of a Data Breach for a Mid-Sized Business in 2026.

What Steps Companies Can Take

Addressing MFA fatigue requires changes to both technology configuration and user behavior. Neither alone is sufficient.

On the technology side, the most important step is moving away from simple push notification approval. Number matching is a more secure alternative: instead of tapping "Approve," the user must enter a number displayed on their login screen into the authentication app. This breaks the fatigue attack because the attacker cannot silently trigger an approval without the user actively participating at the right moment.

Phishing-resistant MFA, such as FIDO2-based hardware security keys or passkeys, goes a step further. These methods are tied to the specific website or application being accessed and cannot be redirected or tricked by an attacker presenting a fake page.

Conditional access policies add another layer. These policies enforce additional checks before granting access: verifying device compliance, flagging logins from unfamiliar locations or unusual times, and requiring step-up authentication for access to sensitive systems. An attacker logging in from an overseas IP at 2 AM should trigger a different response than an employee logging in from their usual office network at 9 AM.

On the human side, employees need specific, practical training. "Never approve an MFA request you did not initiate" is the core message. If notifications start arriving without a corresponding login attempt, the right response is to deny all of them and contact IT immediately.

For more on how endpoint protections layer with identity security, see Endpoint Security in 2026: Why Antivirus Alone Stopped Being Enough Years Ago.

How an MSP Helps

Most businesses have MFA configured, but configuration alone does not guarantee protection. The settings that make MFA genuinely resistant to fatigue attacks require deliberate tuning, ongoing monitoring, and regular policy review.

A managed IT provider handles the configuration work and keeps it current. As attack techniques change and authentication standards improve, the MFA settings protecting your organization need to evolve with them. That is not something that happens automatically, and it is not something that fits naturally into a stretched internal IT workload.

Beyond configuration, an MSP monitors authentication activity for behavioral anomalies. A spike in failed MFA prompts across multiple accounts at an unusual hour is a signal worth investigating. Without visibility into that activity, businesses often do not know they were targeted until the attacker has already succeeded.

Security awareness training is another area where the right partnership makes a measurable difference. Generic annual training tends to underperform. Targeted, scenario-based training that shows employees exactly what an MFA fatigue attack looks like, and what they should do, is far more effective at changing behavior.

Best Practices and Key Takeaways

Audit your current MFA method. If you are using push notification approval without number matching, that is the first thing to change. Most major platforms, including Microsoft Authenticator and Google Workspace, support number matching today.

Evaluate phishing-resistant MFA for high-privilege accounts. Executives, IT administrators, and anyone with access to financial systems or sensitive data are high-value targets. FIDO2 keys or passkeys provide a meaningfully higher level of protection for these accounts.

Train employees on the specific threat. Awareness of MFA fatigue is still surprisingly low outside of IT and security circles. A short, concrete training session covering what the attack looks like and the correct response can close a significant knowledge gap.

Configure conditional access policies. Policies that flag or block logins from unusual locations, unmanaged devices, or outside business hours add friction for attackers without creating significant friction for legitimate users.

Review incident response procedures. If an employee reports a flood of MFA requests, there should be a clear, documented path for what happens next. Who do they contact? What gets locked down immediately? How does IT investigate? Having that process in place before the attack happens is what determines how quickly you contain it.

FAQ

What is MFA fatigue and how does it work?

MFA fatigue is an attack technique where an attacker obtains valid login credentials and then repeatedly sends authentication push notifications to the target's phone. The goal is to overwhelm the user with notifications until they approve one out of frustration or confusion. Once approved, the attacker gains authenticated access to the account.

Does enabling MFA mean my accounts are protected from this attack?

Not automatically. Standard push notification MFA is vulnerable to fatigue attacks. The protection level depends heavily on which MFA method you use and how it is configured. Number matching and phishing-resistant methods like FIDO2 security keys are significantly more resistant to this technique.

How do I know if my organization is being targeted?

Common indicators include employees reporting unexpected MFA notifications when they are not actively logging in, a sudden spike in failed authentication attempts, or logins appearing from unfamiliar geographic locations in your identity provider logs. Monitoring these signals is key to detecting an attack in progress before it succeeds.

What should an employee do if they receive MFA notifications they did not initiate?

Deny all of them. Do not approve any request you did not initiate yourself. Then immediately contact your IT team or helpdesk and report what happened. If your organization has an incident response plan, this event should trigger it. The faster IT can investigate and lock down the account, the less damage can occur.

For more insights into how MSPs turn IT challenges into strengths, check out our article in the Indiana Business Journal here.

Every business faces IT challenges, but you don't have to navigate them alone. Core Managed helps businesses secure their data, scale efficiently, and stay compliant. If you're struggling with any of the issues discussed in this blog, let's talk. Give us a call today at 888-890-2673 or contact us here to schedule a chat.