Understanding MFA Fatigue: Why Cyber Criminals Are Exploiting Human Behaviour

While MFA is extremely effective at preventing unauthorised access, it is not impervious to abuse. MFA fatigue attacks, also known as push bombing or notification spamming, leverage a person’s psychological state to bypass security protocols.?

Attackers flood their intended victim with repeated MFA prompts, often in quickfire succession, hoping to overwhelm or frustrate them into approving one of the requests - unwittingly granting access. Knowing that people have limited patience, particularly with digital interruptions, bad actors exploit this by bombarding users relentlessly. The victim might eventually approve the request just to end the nuisance, often mistaking it for a system glitch or routine error. High-profile breaches, including Uber in 2022, highlight the risks. Cyber criminals often pair push spamming with social engineering to increase success rates.?

Read more here.