SecurityRingBook a Demo

Glossary

What is MFA fatigue (push bombing)?

Also called push bombing: an attacker who already has a password triggers a stream of MFA push prompts until the user approves one by accident or to make them stop.

How it works

CISA’s October 2022 fact sheet explains that attackers who already have a user’s password can generate hundreds of push prompts on the user’s phone in a short time. The user may press accept by accident, out of annoyance, or because they assume one of the prompts is legitimate, and so grants the attacker access.

A real example

CISA published the fact sheet because of threats against accounts that use push-notification MFA. It recommends phishing-resistant MFA first, and number matching as an interim step: the user must type a number shown on the sign-in screen, which a person being push-bombed cannot see.

How to train for it

  • Never approve a prompt you did not start, even once.
  • Treat repeated unexpected prompts as a sign your password is known, and report it.
  • Change your password and tell IT straight away.

SecurityRing does not send MFA prompts. Its credential-harvesting simulations train the step before: not giving the password away.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. CISAImplementing Number Matching in MFA Applications (fact sheet)Published 1 October 2022 · Accessed 17 October 2026.