MFA fatigue and push bombing: how number matching helps

MFA fatigue, also called push bombing, is when an attacker with a stolen password triggers repeated approval prompts until the user accepts one. Number matching helps because the user must type a number shown on the sign-in screen, so a blind tap no longer works. Phishing-resistant MFA is the stronger fix.

How the attack works

The attacker already has the password, often from an earlier phishing page or reuse. They try to sign in, and your authenticator app sends a push. They do it again, and again, sometimes at night. Eventually someone taps Approve to make it stop.

CISA's Scattered Spider advisory lists this as one tactic and adds a variant: posing as IT staff to get employees to share one-time passcodes. The same advisory records SIM swapping, where actors persuade a carrier to move a phone number to a SIM they control.

What number matching changes

Microsoft documents number matching in Authenticator push notifications. The user sees a number on the sign-in screen and has to enter it into the app to approve. Because the number appears only where the real sign-in is happening, an unsolicited prompt cannot be approved by reflex.

Microsoft states that number matching is enabled for all Authenticator push notifications, and that users cannot opt out. It also notes limits: some adapters on older server versions keep the old Approve and Deny experience until updated, and wearables cannot approve number matched prompts.

CISA's archived MFA guidance recommends number matching as a step to help block push bombardment if phishing-resistant MFA is not possible yet.

What it does not fix

Number matching defends against blind approvals. It does not stop a user who is on a phishing page from entering the number, because the attacker is relaying the real sign-in. For that, see adversary in the middle phishing. The answer there is FIDO or WebAuthn, which CISA's Scattered Spider advisory says resists push bombing and SIM swaps.

A practical sequence

1. Turn on number matching, or the equivalent in your provider, today.
2. Limit how many prompts one user can receive in a short window, and alert on bursts.
3. Tell staff what to do: deny, then report. Do not approve a prompt you did not start.
4. Disable SMS as a second factor for admins first.
5. Move admins, email and source control to security keys or passkeys. See which MFA to require.
6. Make sure the help desk cannot be talked into resetting MFA. See the help desk controls.

Quick check

Sources

• CISA advisory AA23-320A, Scattered Spider
• How number matching works in Authenticator push notifications (Microsoft)
• CISA: More than a Password (archived)

Last reviewed: 19 October 2026.