What MFA Bombing Actually Is
MFA bombing, also called MFA fatigue or push bombing, is a social engineering attack, not a technical exploit. After an attacker obtains a user's password—often through phishing or by purchasing it on the dark web—they trigger repeated login attempts.
Each attempt sends a push notification to the user's authenticator app. The goal isn't to break the encryption; it's to annoy, confuse, or overwhelm the target until they accidentally or impatiently tap "Approve" just to make the endless stream of alerts stop. It's a brute-force attack on human patience.
The Psychology of Annoyance and Confusion
This attack vector works because it exploits predictable human behavior. Users are conditioned to see MFA prompts as a normal, trusted part of logging in. An unexpected notification might be denied once or twice, but when they arrive in a relentless flood, the context changes. The user might be in a meeting, distracted, or simply trying to end the incessant buzzing. Attackers rely on this "decision fatigue." The victim may assume a system glitch is causing the repeated alerts, or they might not even be fully paying attention when they finally hit the green button. Some attackers even pair the digital assault with a phone call from a person impersonating IT support, telling the user to approve a prompt to resolve a supposed issue.
Misreading the Signals: Technical Noise vs. Human Distress
Here is where security teams often get it wrong. From a system perspective, an MFA bombing attack can look like a large volume of failed login attempts followed by one success. Security information and event management (SIEM) systems can be flooded with these low-level alerts, which may be dismissed as background noise, a misconfigured application, or a user struggling with their password. Unless alerts are specifically configured to detect a high frequency of MFA prompts for a single user in a short period, the activity might not trigger a high-priority incident. Teams see a storm of denied authentication requests and may incorrectly assume the system is working as intended—blocking unauthorized access—without realizing it's a targeted prelude to a breach.
The Fallacy of 'It's Just Failed Logins'
The critical mistake is viewing the event through a purely technical lens. A security analyst might see dozens of failed logins from a new location and correctly identify them as suspicious. But if they are all denied by the user, the incident might be closed with a note that MFA prevented a breach. The team misses the real story: a specific employee is under active, psychological duress. The final, successful login isn't just one more event in a sea of data; it's the culmination of a targeted social engineering campaign. Without correlating the rapid-fire denials with the eventual approval, the true nature of the attack is completely misread.
Shifting the Defense: People, Process, and Technology
Preventing MFA bombing requires more than just having MFA enabled. Organizations are now moving toward stronger controls. Limiting the number of MFA requests allowed within a certain timeframe is a simple first step. More robust solutions include implementing number matching, where a user must enter a specific code from the login screen into their app, preventing accidental approvals. Others are adopting risk-based authentication, which adds more friction if a login attempt comes from an unusual device or location. Ultimately, the most effective defense combines smarter technology with user education, teaching employees to recognize the signs of an MFA bombing attack and immediately report it to IT security rather than just denying the prompts.
