Multi-factor authentication was supposed to be the answer. And for years, it was enough to stop most attackers cold. But cybercriminals adapt fast – and they have found a devastatingly simple way around MFA that does not require any technical skill whatsoever. It is called an MFA fatigue attack, and it has already been used to breach major organisations including Uber, Microsoft, and Okta. For Australian small businesses, understanding this attack is urgent – because the tools to stop it are already available, and the cost of being unprepared is significant.
What Is an MFA Fatigue Attack?
An MFA fatigue attack – also called MFA push bombing – is a social engineering technique where an attacker who already has a victim’s username and password floods their phone with repeated authentication push notifications.
The goal is simple: annoy or confuse the target into approving a login they did not initiate.
Here is how it unfolds:
- Attacker obtains credentials via phishing or a data breach
- Attacker repeatedly attempts login, triggering MFA push requests to the victim’s phone
- Victim receives dozens of approval prompts – often in the middle of the night
- Victim, confused or exhausted, taps “Approve” just to make it stop
- Attacker is in
Some attackers pair this with a phone call pretending to be from IT support, creating urgency and accelerating the approval. The entire attack requires zero technical exploitation on the attacker’s part.
Learn how Netlogyx Security Awareness Training protects your staff
Why MFA Fatigue Attacks Are So Effective Against SMBs
Most small and medium businesses have deployed basic MFA – often the simple “approve/deny” push notification style. While this is far better than no MFA, it creates the exact vulnerability that MFA fatigue exploits.
The reasons SMBs are particularly exposed:
- No number matching: Staff approve pushes without verifying a code matches what they see on screen
- No security awareness training: Employees do not know this attack exists
- No anomaly detection: Nobody is monitoring for repeated failed logins followed by an approval from an unusual location
- After-hours attacks: Attackers time their push flood for 2am when staff are asleep and less alert
The MFA fatigue attack works because it exploits human psychology, not technical vulnerabilities.
How to Protect Your Business Against MFA Fatigue
The good news is that this attack is entirely preventable. Here is what Netlogyx recommends:
1. Switch to Number Matching MFA
Authenticator apps like Microsoft Authenticator now support number matching – the app shows a number that must match what appears on the login screen. This stops blind approvals dead.
2. Enable Additional Context in Push Notifications
Show the user the geographic location and the device making the request. An approval prompt showing “Login attempt from Romania” is much harder to accidentally approve.
3. Move to Phishing-Resistant MFA
FIDO2 hardware keys (like YubiKeys) or passkeys are the gold standard. They cannot be intercepted, bypassed, or bombed.
4. Implement Conditional Access Policies
Block login attempts from unexpected countries, unusual devices, or outside of business hours where possible.
5. Train Your Staff
Employees should know to never approve an MFA request they did not initiate – and to immediately call IT support if they receive unexpected push notifications.
Explore our Vulnerability Management service to identify credential exposure risks
The Broader Picture: Credential Security in 2026
MFA fatigue attacks are one part of a broader credential security problem. Billions of username and password combinations are available for sale on the dark web right now. Attackers can automate credential stuffing attacks at scale – trying stolen logins against your Microsoft 365, Google Workspace, or accounting software with no effort.
The ACSC’s Essential Eight framework recommends implementing phishing-resistant MFA as a priority control for all Australian businesses. This is not bureaucratic box-ticking – it is the direct response to the attack methods being used against Australian businesses today.
Read about our Managed IT Support and security posture management
Is Your MFA Implementation Actually Protecting You?
Basic push approval MFA is no longer enough. Netlogyx can audit your current authentication setup, identify exposure to MFA fatigue attacks, and upgrade your controls to phishing-resistant methods — without disrupting your team.
- Review your current MFA configuration across all platforms
- Upgrade to number matching and additional context notifications
- Train your staff on recognising and responding to MFA push flooding
Frequently Asked Questions
Q: We already have MFA set up. Are we protected from MFA fatigue attacks?
A: Not necessarily. If you are using simple push notification approval without number matching or additional context, you remain vulnerable. The type of MFA matters as much as having it in the first place.
Q: What is the most secure form of MFA for a small business?
A: FIDO2 hardware security keys are the gold standard and are completely immune to MFA fatigue and phishing. For businesses not ready for hardware keys, number matching combined with contextual push notifications is a strong step forward.
Q: How do I know if my accounts are being targeted?
A: Unexpected MFA push notifications are the clearest warning sign. Staff should be instructed to report these immediately. Monitoring sign-in logs for repeated failed attempts is also essential.
Do Not Let a Tired Employee Be Your Weakest Link
MFA fatigue attacks are a reminder that technology alone does not create security. People are always part of the equation – and attackers know it. The solution is not to blame your staff. It is to give them better tools and better training so that approving a malicious login becomes impossible, not just unlikely.
Netlogyx keeps Australian SMBs ahead of exactly these kinds of evolving threats.
(We are not looking to replace your current provider, just offering an alternative perspective)
Written by Neil Frick
Sources & References
- ACSC Essential Eight – https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
- Microsoft Guidance on MFA Fatigue – https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match
- CISA MFA Best Practices – https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf