MFA Fatigue and Push Bombing: How Number Matching and Better Settings Stop Approval Spam

MFA fatigue, also called push bombing, is an attack where someone who already has an employee's password triggers sign-in approval requests over and over until the employee taps "Approve" by mistake or just to make the notifications stop. If your business uses push notifications for multi-factor authentication (MFA), the fix is straightforward: make sure number matching is in place, show the app name and location in each prompt, let staff report suspicious prompts with one tap, tighten Conditional Access, and teach everyone one rule: if you did not just try to sign in, deny it and tell IT. For your most powerful accounts, move to phishing-resistant MFA.

If you are still deciding which MFA methods to use, start with our MFA guide for businesses. This article focuses on one specific weakness of push-based MFA and how to close it.

How a push bombing attack works

Push bombing does not break MFA. It works around the person holding the phone.

1. The attacker gets a password. Usually through phishing, a reused password from an old breach, or password guessing.
2. They sign in and trigger a push. Each attempt sends a "Are you trying to sign in?" notification to the employee's phone.
3. They repeat it. Sometimes late at night, sometimes dozens of times in a row, sometimes paired with a phone call or text pretending to be the IT help desk ("We're fixing your account, just approve the prompt").
4. One tap is enough. If the employee approves even once, the attacker is in.

This is not theoretical. CISA's joint advisory on the Scattered Spider group lists "push bombing" and sending repeated MFA prompts "leading to employees pressing the 'Accept' button" among the techniques the group used to get past MFA. CISA's fact sheet on number matching describes the same pattern as MFA fatigue.

Number matching: what it is and whether you already have it

With number matching, the sign-in screen shows a number and the user must type that number into the authenticator app to approve. An attacker sitting somewhere else can trigger the prompt, but the employee never sees the number on their own screen, so a reflex tap cannot complete the sign-in.

CISA recommends phishing-resistant MFA as the goal and describes number matching as a strong interim step for organizations that cannot get there right away.

Microsoft 365 and Microsoft Entra ID

Microsoft enforced number matching for all Microsoft Authenticator push notifications starting in May 2023, and its documentation states that number matching "is enabled for all Authenticator push notifications" and that users cannot opt out. In most Microsoft 365 tenants there is nothing to turn on, but check these exceptions:

• NPS extension (VPN and RD Gateway sign-ins through RADIUS): NPS does not support number matching. Recent versions of the NPS extension prompt for a one-time code (TOTP) instead of Approve/Deny when the user has one registered; older versions may still show Approve/Deny. Keep the extension current.
• AD FS adapter: number matching requires the Windows Server updates listed in Microsoft's documentation; unpatched servers still show Approve/Deny.
• Old Authenticator versions: users on outdated app versions cannot sign in with push until they update. Use this as a reason to keep company phones managed and updated (see our Microsoft Intune service).

Google Workspace

Google prompts show the device, location and time of the sign-in attempt, and Google says that when it notices something unusual, such as a different location, it may ask the user to match a number shown on the computer with one on the phone. Admins can go further and require security keys for 2-Step Verification, which takes push approvals out of the picture for those users.

Add context to every prompt

A number alone tells the employee "this is a real sign-in," not "this is my sign-in." Microsoft Authenticator can also show the application name and the geographic location (based on IP address) of the sign-in. An employee in Doral who sees a request for an app they are not using, from a city they have never visited, has a clear reason to deny it.

Here is the detail many small businesses miss: Microsoft lists both of these settings as Microsoft managed, and today the Microsoft managed value for each is Disabled. If you want them, set them to Enabled yourself:

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Go to Entra ID > Authentication methods > Microsoft Authenticator.
3. On the Configure tab, set Show application name in push and passwordless notifications and Show geographic location in push and passwordless notifications to Enabled for all users (or a pilot group first).
4. Save, then test with a few users before announcing it.

Note that location is approximate and can be wrong for VPN users, so tell staff to use it as a clue, not proof.

Let staff report a suspicious prompt with one tap

Denying a prompt stops that attempt, but the attacker still has the password. You want to know about it the same minute.

Microsoft's Report suspicious activity feature lets a user flag an unexpected MFA prompt from Microsoft Authenticator or by phone. Reported users are marked High User Risk, and the event appears in sign-in logs, audit logs and the risk detections report. Like the context settings, its Microsoft managed value is Disabled, so enable it under Entra ID > Authentication methods > Settings.

What happens next depends on your licensing:

• With Microsoft Entra ID P2, a risk-based Conditional Access policy can block high-risk users or require a secure password change automatically.
• With P1 or below, someone must watch for these events and act: reset the password, revoke sessions and review recent sign-ins. A managed IT provider can monitor this for you.

Reduce how often prompts can be abused

Tighten Conditional Access

Conditional Access policies (Microsoft Entra ID P1 and above) decide when MFA is required and what else must be true. Useful policies against push bombing include:

• Block legacy authentication, which cannot do modern MFA at all.
• Require a compliant or company-managed device for email, files and admin portals, so a stolen password plus an approved prompt still fails from an attacker's laptop.
• Restrict or add friction to sign-ins from countries where you have no staff.
• Require phishing-resistant MFA (an "authentication strength") for administrators.

Respond to the first sign of an attack

An employee receiving prompts they did not request means their password is already known to someone else. Treat it as an incident, not a nuisance:

1. Reset the password and revoke active sessions.
2. Check sign-in logs for where the attempts came from and whether any succeeded.
3. Look for new inbox rules, forwarding or newly registered MFA methods on the account.
4. Ask whether the employee reused that password elsewhere.

Our phishing red flags guide covers how passwords are usually stolen in the first place, and a password manager rollout makes reuse much less likely.

Train people on one simple rule

Technology closes most of the gap, but the final decision is a human tap. Keep training short and repeat it:

• You will only ever see a prompt right after you sign in yourself. Any other prompt is an attack.
• Deny it, then report it (with the report option in the app, or by calling IT).
• IT will never call or text you asking you to approve a prompt or read a code. Anyone who does is the attacker.
• Many prompts in a row is not a glitch. It is someone with your password.

Bilingual teams should get these rules in English and Spanish; a one-page card in both languages works well.

The long-term fix: phishing-resistant MFA

Number matching stops reflex approvals, but it can still be defeated by a convincing fake sign-in page that relays the number. CISA's guidance is clear that phishing-resistant methods, such as FIDO2 security keys and passkeys, are the strongest option and are not susceptible to push bombing. A practical path for a small business:

1. Start with administrators and anyone who approves payments.
2. Use Conditional Access authentication strengths to require phishing-resistant methods for those groups.
3. Expand to the rest of the staff as devices are replaced.

Pair this with the baseline in our Microsoft 365 security settings checklist.

Quick checklist

Step	Microsoft 365	Google Workspace
Number matching	Enforced for Authenticator push; check NPS and AD FS	Shown when Google detects unusual sign-ins
App and location context	Enable (Microsoft managed = Disabled)	Device, location and time shown in prompts
One-tap reporting	Enable Report suspicious activity	Deny the prompt, then report to IT
Phishing-resistant MFA	Authentication strengths for admins	Require security keys for admins
Staff rule	Deny and report any prompt you did not start	Same

If you want help checking these settings, monitoring risky sign-ins or rolling out security keys, our cybersecurity team works with businesses across Miami-Dade and South Florida, in English and Spanish. Request a free IT assessment and we will review your MFA setup with you.

Sources

• How number matching works in MFA push notifications for Authenticator (Microsoft Learn)
• Use additional context in Authenticator notifications (Microsoft Learn)
• Protecting authentication methods in Microsoft Entra ID: Microsoft managed settings (Microsoft Learn)
• Configure Microsoft Entra multifactor authentication: Report suspicious activity (Microsoft Learn)
• Microsoft enforces number matching to fight MFA fatigue attacks (BleepingComputer)
• Implementing Number Matching in MFA Applications (CISA fact sheet)
• Implementing Phishing-Resistant MFA (CISA fact sheet)
• Scattered Spider, advisory AA23-320A (CISA)
• Sign in with Google prompts (Google Account Help)