Somewhere around the fifth login prompt in a row, most people stop reading and just start tapping “approve” to make the notifications stop. That reflex has a name now, and security teams take it seriously enough to have built an entire attack category around it: 2FA fatigue. It’s the point where a security measure designed to protect an account quietly becomes the exact thing an attacker relies on to get into it.
What 2FA Fatigue Actually Looks Like
The mechanics are almost embarrassingly simple. An attacker who already has a stolen password can’t get past a second authentication step on their own, so instead of trying to break the encryption, they lean on human exhaustion. They trigger the login prompt repeatedly — sometimes dozens of times in a row, sometimes spaced out over hours — until the account owner approves one out of confusion, irritation, or the assumption that it’s some kind of glitch rather than an active attack. Microsoft’s own security research team has tracked this at scale, detecting over 382,000 MFA fatigue attempts in a single year, with roughly one percent of targeted users approving the very first unexpected push notification they received.
This isn’t a hypothetical threat model — it’s already caused real breaches. The 2022 intrusion into Uber’s internal systems started this exact way: an attacker with a stolen contractor password flooded the contractor’s phone with repeated push prompts late at night, then contacted them directly pretending to be IT support, until the exhausted contractor approved one just to make it stop. Within minutes, that single approval handed over access to internal Slack channels, VPN infrastructure, and source code repositories. No password was cracked and no encryption was broken — the entire breach ran on push notification bombing and plain human fatigue.
Why This Counts as Too Much Security Friction
Here’s the uncomfortable part for security teams: 2FA fatigue isn’t purely an attacker-side problem. Security UX research points out that constant, routine authentication friction primes people to treat prompts as background noise rather than meaningful security checkpoints in the first place. If someone gets legitimate MFA requests dozens of times a week for perfectly normal logins, an unexpected malicious prompt doesn’t stand out — it just blends into a pattern they’ve already learned to clear without much thought. Ironically, organizations that pile on the most too much security friction in the name of caution can end up training their own employees toward the exact habituated, low-attention approval behavior that makes fatigue attacks work.
This is the core paradox of MFA prompts as a security layer: they’re only effective as long as the person on the receiving end treats each one as a decision rather than a chore. Once that shifts, the extra step stops functioning as a barrier and starts functioning as a single point of human failure that attackers have gotten very good at targeting deliberately.
Why User Compliance Breaks Down
User compliance with security prompts isn’t a fixed trait — it degrades under exactly the conditions modern workplaces create by default. Late-night notifications, prompts arriving mid-task, and repeated identical requests all chip away at the careful scrutiny a security prompt is supposed to receive. Attackers running these campaigns count on this specifically, often timing bombardment for hours when a target is least likely to stop and think clearly, which is exactly why the Uber attack happened at night rather than during a normal workday.
This connects to a pattern covered in how notifications are designed to interrupt you at the worst time — the same design mechanics that make notifications effective at grabbing attention also make repeated ones exhausting enough to override good judgment when the volume gets high enough. It’s also related to is two-factor authentication really safe, since the answer increasingly depends less on the technology itself and more on how resistant the approval flow is to exactly this kind of exhaustion-based manipulation.
What Actually Reduces 2FA Fatigue Risk
The fix security teams have converged on isn’t removing MFA — it’s removing the reflexive tap-to-approve step that makes fatigue exploitable in the first place. Number-matching, which requires a user to enter a code shown on their login screen into the prompt rather than just tapping approve, breaks the mindless-approval pattern because it forces a small moment of actual attention. Phishing-resistant methods like hardware security keys or biometric-based passkeys go further by removing the push notification entirely, which closes the fatigue vector completely since there’s no prompt left to bomb. Treating repeated denied prompts as an active alert, rather than background noise, is another layer many security teams have adopted specifically because a burst of declined requests is often the clearest early signal that an attack is already underway.
FAQ
What is 2FA fatigue?
It’s a social-engineering technique where an attacker who already has a stolen password floods a user’s device with repeated authentication prompts, hoping exhaustion or confusion leads them to approve a malicious login just to stop the notifications.
Why do people fall for MFA fatigue attacks?
Routine authentication friction trains people to clear prompts quickly without much scrutiny, so when a malicious prompt arrives, it often doesn’t look different enough from the dozens of legitimate ones a person handles every week.
Does this mean two-factor authentication doesn’t work?
No — it means the tap-to-approve version of MFA has a specific weak point. Number-matching and phishing-resistant methods like security keys close that gap while keeping the extra protection MFA provides.
How can I protect myself from push notification bombing?
Never approve a prompt you didn’t personally initiate, even if the notifications feel relentless. Treat a sudden burst of unexpected requests as a strong signal your password may already be compromised, and report it rather than approving anything to make it stop.
Conclusion
2FA fatigue isn’t proof that extra security steps are pointless — it’s proof that a security measure only works as long as the person using it is still paying attention to it. Closing that gap with number-matching or passkeys keeps the protection MFA was built for, without leaving human exhaustion as the weakest link in the chain.