MFA Fatigue Attacks: Why Your Phone Keeps Buzzing (and How Passkeys Stop It)

Picture this. It's 11 p.m., you're finally in bed, and your phone starts buzzing. A login approval prompt. You dismiss it. Ten seconds later, another one. Then another. By the fifth or sixth buzz, you're annoyed, half asleep, and thinking "ugh, one of my apps must be glitching." So you tap "Approve" just to make the noise stop.

Congratulations, you may have just handed a stranger the keys to your business.

That's an MFA fatigue attack, and it's one of the sneakiest tricks in the modern hacker's playbook. The good news is that once you understand how it works, defending against it is genuinely straightforward. Even better, there's a newer technology called passkeys that makes this entire category of attack impossible. Let me walk you through all of it.

First, what is MFA and why does it matter so much?

MFA stands for multi-factor authentication. It's the security step where, after you type your password, a site asks for a second proof that you're really you. That second proof is usually a code texted to your phone, a six-digit number from an app, or a "tap to approve" notification. The idea is simple: even if a crook steals your password, they still can't get in without that second factor sitting in your pocket.

And it works astonishingly well. Microsoft's security team famously found that turning on MFA blocks more than 99.9 percent of automated account-takeover attacks. A later Microsoft research study put the figure at over 99.2 percent across all account-compromise attempts. Whichever number you use, the takeaway is the same: MFA is the single highest-value security switch a small business can flip. If you take nothing else from this article, turn MFA on everywhere.

Here's the part most articles skip, though. Not all MFA is created equal. Some kinds are genuinely strong. Others have a soft underbelly that attackers have learned to exploit, and that soft underbelly is exactly what MFA fatigue attacks target.

How an MFA fatigue attack actually works

Let me be real with you: this attack is almost embarrassingly low-tech. There's no elite hacking wizardry involved. It's psychology.

Step one, the attacker gets your password. This is easier than you'd hope. Stolen passwords are everywhere thanks to old data breaches and reuse across sites, which is the exact fuel behind credential stuffing attacks. Stolen credentials were the way in for a huge share of breaches, and Verizon's 2024 Data Breach Investigations Report found that the use of stolen credentials appeared in roughly a third of breaches over the past decade. So assume a determined attacker can get your password.

Step two, they hit a wall: your MFA. If you're using the "tap to approve" push-notification style of MFA, that wall has a doorbell. Every time the attacker types your password into the login page, your phone gets a push notification asking "Was this you? Approve or Deny." So they just keep typing your password. Over and over. Login attempt after login attempt.

Step three, the buzzing begins. Your phone lights up with approval prompt after approval prompt. Sometimes they space them out to wear you down over hours. Sometimes they blast dozens in a row. This tactic even has other nicknames: MFA bombing, push bombing, and push spam. The goal is to get you to tap "Approve" out of confusion, annoyance, exhaustion, or the reasonable-sounding assumption that it must be a glitch.

And here's the truly diabolical part. Attackers will often pair the spam with a message. They'll ping you on WhatsApp or Teams pretending to be your own IT department: "Hi, we're pushing a system update, please approve the prompt on your phone to complete it." Now the buzzing has a plausible explanation, and you tap yes. That "helpful IT" message is a close cousin of business email compromise, where attackers impersonate someone you trust to get you to act.

The real-world example: how Uber got popped

If this sounds theoretical, it isn't. In September 2022, this exact playbook took down Uber.

An attacker linked to the Lapsus$ group got hold of an Uber contractor's password, most likely bought off the dark web after an earlier malware infection. The password alone wasn't enough because Uber used MFA. So the attacker flooded the contractor with a steady stream of push notifications over about an hour. When that didn't immediately work, they messaged the contractor on WhatsApp posing as Uber IT and said the notifications would stop once the login was approved. The worn-down contractor approved one. That single tap gave the attacker a foothold inside Uber's internal network.

Uber is a company with a serious security budget. If MFA fatigue can breach them, it can absolutely breach a ten-person business. And security researchers have noted that MFA fatigue became a favorite tactic precisely because it's cheap, requires no special tools, and preys on a normal human response to an annoying phone.

Not all MFA is equal: the strength hierarchy

So if the "tap to approve" style has this weakness, what should you use instead? Think of MFA methods as a ladder, from weakest at the bottom to strongest at the top.

Here's the ladder, from most exposed to most bulletproof:

| MFA method | How it works | The weakness | |---|---|---| | SMS text codes | A code is texted to your phone | Phishable, and vulnerable to SIM swapping | | Authenticator app codes (TOTP) | A 6-digit code that rotates every 30 seconds | Phishable if you type it into a fake site | | Push with number matching | You type a shown number into your app to approve | Very strong; blocks blind approvals | | Passkeys and hardware keys | Cryptographic proof tied to the real website | Phishing-resistant by design |

Let me unpack the two ends.

SMS codes are the weakest. They feel convenient, but a text message can be intercepted, and worse, criminals can pull off a "SIM swap," where they trick your mobile carrier into transferring your phone number to a SIM card they control. Suddenly your codes go to them. SMS is still far better than no MFA at all, but it's the floor, not the goal.

Authenticator app codes (that's TOTP, or time-based one-time password, the rotating six-digit number in apps like Microsoft or Google Authenticator) are a solid step up. No SIM to hijack. But there's still a catch: if a fake login page tricks you into typing that code, the attacker can grab it and use it in real time. It's phishable.

Push with number matching is a big leap. Regular "tap to approve" push is what fatigue attacks exploit. Number matching fixes it: instead of a lazy yes/no tap, the login screen shows you a two-digit number that you must type into your app to approve. You can't approve on autopilot, and you can't approve a login you didn't start, because you don't have the number. This defense worked so well that Microsoft made number matching the default for all its Authenticator push notifications in May 2023, specifically to shut down fatigue attacks. The Register confirmed that admins can no longer opt out. If you use push MFA, turn this on today.

At the top of the ladder sit passkeys and hardware security keys. These are the only methods the U.S. Cybersecurity and Infrastructure Security Agency (CISA) calls truly phishing-resistant, the gold standard for MFA. And this is where things get genuinely exciting, so let's dig in.

Passkeys, explained without the jargon

A passkey is a fundamentally different way to prove who you are. Instead of a secret you know (a password) or a code you copy (an SMS or TOTP), a passkey is a cryptographic key pair. That sounds intimidating, so here's the plain-English version.

When you create a passkey for a website, your device generates two mathematically linked keys. One is a public key, which the website keeps. The other is a private key, which never, ever leaves your device. Think of the public key as a padlock the website hangs on its door, and the private key as the only key that opens it, welded permanently inside your phone or laptop.

To log in, the website sends your device a puzzle that only the matching private key can solve. Your device solves it and sends back the answer. You unlock your device to authorize this with something you already use: your fingerprint, your face, or your device PIN. That's it. No password to type, no code to copy, nothing for you to memorize.

This is built on an open standard called FIDO2 (and its web component, WebAuthn), created by an industry group called the FIDO Alliance whose members include Apple, Google, and Microsoft. Because it's a shared standard, passkeys work across the whole industry rather than locking you into one vendor.

Why passkeys cannot be phished or spammed

Here's the elegant part, and why passkeys kill MFA fatigue dead:

A passkey is bound to the real website's exact address. Your private key will only respond to the genuine site it was created for. If an attacker builds a pixel-perfect fake login page, your passkey simply refuses to engage, because the web address doesn't match. There's no code for you to accidentally type into the fake site, because there's no code at all. The phishing trap has nothing to catch.

There's nothing to spam you into approving. Passkey logins start on your side, when you choose to sign in. An attacker who has your (now useless) password can't trigger a passkey prompt on your phone from across the internet. The 11 p.m. buzzing attack has no doorbell to ring.

There's no shared secret to steal. Since your private key never leaves your device and is never sent anywhere, there's nothing sitting on the website's server for a breach to expose. Even if a company you use gets breached, your passkey can't be lifted from it.

In short, passkeys don't just add a stronger lock. They remove the things attackers actually steal.

This is not a science experiment. It's here.

Passkeys have gone mainstream faster than almost any security technology in memory. According to the FIDO Alliance, more than 15 billion online accounts can now use passkeys, roughly double the year before. Google reported that over 400 million accounts had used passkeys more than a billion times, and that passkeys are 50 percent faster than passwords. Amazon rolled them out to its user base with 175 million passkeys created. The FIDO Alliance's 2025 Passkey Index tracks the technology crossing into everyday use. Chances are your Microsoft 365, Google Workspace, and banking accounts already support them right now.

How a small business can actually roll passkeys out

You don't need an IT department or a big budget. Here's a realistic path.

Start with your crown-jewel accounts. Your email and your identity platform (Microsoft 365 or Google Workspace) are the master keys to everything else. Enable passkeys there first. Both platforms have passkey support built in, and you can add a passkey in account settings in a couple of minutes per person.

Let people use the device they already own. A passkey can live on a modern phone or laptop and unlock with the fingerprint or face scan people already use. For most small teams, that means zero extra hardware to buy. Employees create a passkey on their work phone or computer and they're done.

Consider hardware keys for your highest-risk roles. For the owner, the bookkeeper, and anyone with admin access, a physical security key (a small USB or tap-to-use device, roughly the price of a nice dinner) adds a passkey you can hold in your hand. It's the same phishing-resistant technology in a dedicated form.

Don't rip out your old MFA overnight. Passkeys can coexist with your existing MFA during the transition. Add passkeys as the preferred method, keep an authenticator app as backup, and phase out SMS over time.

Your action plan

Here's the concrete checklist. Do these in order and you'll have shut the door on MFA fatigue attacks.

1. Turn on MFA everywhere it isn't already on. Email, banking, payroll, your website admin, every cloud tool. This one step blocks the vast majority of automated attacks, full stop.
2. Switch on number matching for any push-based MFA. If your app supports it (Microsoft Authenticator enables it by default now), make sure it's active. This alone neutralizes the classic fatigue attack.
3. Kill SMS-based codes wherever a better option exists. Keep SMS only as a last-resort fallback for services that offer nothing else. Prefer an authenticator app or, better, a passkey.
4. Adopt passkeys on your most important accounts. Start with email and your identity platform, then expand. Use hardware keys for admins and anyone with access to money.
5. Train your team on the one golden rule. Never approve a login prompt you didn't personally start, and never let a message from "IT" pressure you into approving one. If your phone is buzzing with logins you didn't trigger, that's not a glitch, it's an attack, and it means someone already has your password. Change it immediately.

If your team is small and you'd rather have this set up and monitored for you, this is exactly the kind of thing a small business cybersecurity partner handles as routine housekeeping.

The takeaway

MFA fatigue works by turning your own MFA against you, wearing you down until you tap the wrong button. But you now know the fix cold: turn on number matching, retire SMS, and move your important accounts to passkeys, the one method that can't be phished, can't be spammed, and doesn't rely on you making the right split-second decision at 11 p.m. Your phone can stop being a liability and go back to being a phone.