MFA push fatigue is when an attacker with a stolen password triggers approval prompts again and again until the user taps yes. Number matching, prompt rate limits and monitoring reduce the risk, and a phishing-resistant method such as a passkey removes the approval tap altogether.
How the attack works
The attacker already has a valid username and password, often from an earlier breach or phishing page. They try to sign in repeatedly. Each attempt sends a push to the real user's phone. Late at night or in a busy day, the user may approve one to make the noise stop.
OWASP describes it the same way: attackers flood users with push prompts until one is approved.
What number matching changes
With challenge-response push, the login screen shows a number and the user has to type or choose it in the app. A blind tap no longer works, because the person approving must see the sign-in screen the attacker is looking at. That does not help if the user is on the phone with the attacker, but it does stop reflexive approvals.
Controls to apply together
- Require number matching for every push prompt.
- Cap prompts. Rate limit or cap pushes per account, as OWASP suggests.
- Monitor bursts. Alert on many prompts in a short time and on reuse of a token from a new device.
- Add context. Show app name and location in the prompt where your tool supports it.
- Offer a report button so a user can flag a prompt they did not start. Treat reports as an incident signal, and reset the password.
- Move admins off push. Passkeys and security keys have no approve button to mash. See which MFA to require.
What to do when it happens
- Reset the password and revoke sessions for the account.
- Check sign-in logs for any approved prompt you did not expect.
- Look for the same password on other accounts. Credential reuse is the usual root cause. See credential stuffing, brute force and password spraying.
Train staff with one simple rule: if you did not just try to sign in, never approve, and report it. Pair that with a visible way to report, such as a button in the prompt or a short chat command to the security channel. Fast reporting turns a failed attack into an early warning, because a burst of unexpected prompts means a valid password is already in someone else's hands.
Quick check
Does number matching stop push fatigue completely?
It stops blind approvals. A user who is socially engineered into typing the number can still be caught, so pair it with prompt caps and monitoring.
Is TOTP affected by fatigue?
No prompt is sent, so there is nothing to flood. It can still be phished by a fake page that asks for the code.
Sources
Last reviewed: 19 October 2026.
