Your Password Is Already Gone. Now What?
Multi-factor authentication was built on a sound idea: knowing the password is not enough. A second confirmation closes the gap, usually a push notification to your phone or a one-time code. Attackers adapted. The technique called MFA fatigue turns that second factor against you, and it works precisely because your employees are busy.
What the Attack Looks Like from the Employee’s Side
Picture a Tuesday afternoon. A law firm paralegal, or a project manager out at a job site, gets a push notification: Approve sign-in? They did not try to log in. They tap Deny and go back to work.
Then another prompt arrives. Then another. Over the next hour, the phone buzzes a dozen times. The paralegal is on a call. The project manager is reviewing a bid. At some point, tired of the interruption and assuming a glitch, someone taps Approve.
That single tap hands an attacker full access to the account. The attacker already had the password, likely purchased from a breach database or harvested through phishing. The push prompt was the only lock left on the door.
A second version of the attack skips the fatigue entirely. The attacker calls the employee directly, claims to be from IT or a help desk, and says an urgent security issue requires a verification code. The employee reads the code aloud. The attacker enters it. Access granted.
Why Busy People Are Vulnerable
This is a failure of attention bandwidth, and attackers count on it. Intelligence has nothing to do with it.
Push prompts are designed to be frictionless. That frictionlessness is the feature that becomes the liability. When approving a sign-in takes one tap, denying a flood of prompts takes sustained, deliberate effort. That effort competes with every other demand on a person’s time.
The social-engineering call works on a different mechanism: authority and urgency. Someone who sounds like IT and manufactures an emergency is exploiting the same instinct that makes organizations function. People follow reasonable-sounding instructions from apparent colleagues. Attackers rehearse for this.
What Defense Actually Looks Like
The layers below work together.
Number-matching prompts. Modern authentication apps can require the employee to type a two-digit number displayed on the sign-in screen into the phone app before approval is granted. A flood of prompts becomes useless because each one requires active cognitive engagement. Tapping yes out of reflex is no longer possible.
Sign-in monitoring that challenges unusual patterns. When a sign-in attempt originates from an unfamiliar location or a device the account has never seen, the system should challenge it or block it outright, rather than sending a push and waiting. Monitoring that flags these patterns and alerts your IT team means a fatigue attack generates a visible signal instead of a silent breach.
A culture where declining and reporting is the right answer. This is the layer that gets skipped most often. Employees need to know, in plain terms, that an unexpected prompt should be denied and reported immediately, never investigated on their own. The organizations where this works well are the ones where someone who flags a suspicious prompt gets a thank-you, not a shrug. That response has to be consistent and visible.
None of these layers is optional on its own. Number-matching without monitoring leaves gaps. Monitoring without culture means the human layer still fails under pressure.
The Broader Point
MFA fatigue attacks succeed because they work around the technical control by targeting the person holding the phone. Closing that gap requires a stronger technical prompt design and an environment where employees feel confident pushing back on anything unexpected, even when it turns out to be nothing.
If you are not certain your authentication setup includes number-matching, or if your team has never had a direct conversation about what to do when prompts arrive uninvited, those are gaps worth addressing before an attacker finds them first.
Lambert Technology Solutions works with small businesses across Illinois to build authentication postures that hold up under real-world pressure. A conversation about where yours stands costs nothing.