MFA fatigue: when “Approve” becomes the attack
Someone with your password spams login prompts until you tap Approve. Four settings stop it.
The attacker already has the password. They try to log in again and again, and your phone keeps asking “Approve?”, often late at night. Sooner or later someone taps Approve to make it stop. It was part of the Uber breach in 2022.
What stops it:
- Number matching. The user types the number shown on the login screen. You can’t approve by accident from bed. Microsoft made it mandatory in Authenticator in 2023; turn it on wherever you can.
- Show where the login comes from in the prompt. “Another country” makes people stop.
- Alert on repeated denials. Several in a row means the password is known. Reset it today.
- Passkeys or hardware keys for admins and finance. No Approve button to abuse.
And one sentence for the whole team: if you get a prompt you didn’t ask for, press Deny and tell IT. We will never ask you to approve one.