MFA Fatigue and Number Matching: Why the Prompt Is the Control
Multi-factor authentication is usually described as a control that stops credential theft. It does, up to a point. The gap that attackers found is simpler than a cryptographic break: if the second factor is a push notification with an approve button, the attacker can make the phone ring until someone taps it.
This technique is documented as MFA fatigue, or push bombing. Its defining characteristic is that nothing is compromised. The user approves an attacker's login because the request looked familiar enough at 2am.
How the attack works in practice
The sequence has four steps. The attacker obtains a valid username and password, often from a password spray or a credential dump. They start a login. The identity provider sends a push notification to the enrolled device. The attacker repeats the login attempt many times, producing a stream of prompts. Somewhere in that stream, a tired user approves one, or a user who assumes the prompt is a glitch taps approve to make it stop.
The attack is not sophisticated. Its success rate depends entirely on how the prompt is designed and how the user was trained.
Why number matching changes the calculus
With number matching, the sign-in screen displays a number, and the approver must type that number into the authenticator app. The prompt alone is no longer enough. An attacker who can trigger a push cannot see the number on the victim's screen, so a user who taps approve without entering the number fails, and a user who reads the prompt sees that the number they are being asked for is not the number on their screen.
Microsoft made number matching the default for its authenticator push notifications, and the reasoning generalises beyond one vendor. The prompt moves from a binary yes/no to a challenge that requires sight of the legitimate session.
Two related controls reinforce it. Additional context in the prompt, such as the application name and the approximate location of the sign-in, gives the user information to reject an unexpected request. And a rate limit on how many push notifications can be generated for one account in a window removes the attacker's ability to create the stream in the first place.
What to configure, and what to check
A workable configuration has four elements.
Require number matching for every push-based second factor. If any enrolled authenticator can still approve without entering a code, that path remains open for the accounts that use it.
Show application and location context in the prompt. Context only helps if the user has been told what to do with it.
Rate limit or suppress repeated pushes for the same account, and alert when the limit is hit. A burst of rejected pushes for one account is one of the clearest signals that an attacker holds a valid password.
Give users a reporting path that is not the approve button. If the only options on the prompt are approve and deny, users who are unsure will choose one of the two.
Turning user reports into detection
Vendors that surface denied or rejected push notifications give defenders a high-quality signal with a low false-positive rate. A user who denies a push they did not initiate is reporting an active credential compromise, and that should open an investigation rather than close a ticket.
The same logic applies to a burst of prompts for one account, or a prompt that arrives with a location the user has never signed in from. Those events are worth alerting on individually, because each one means an attacker already has the first factor.
The uncomfortable part
MFA fatigue is often described as a user-awareness problem. It is more accurate to describe it as a design problem. If a control can be satisfied by a user who is tired, confused, or simply trying to stop their phone buzzing, then the control delegates its security property to human attention under adverse conditions. Number matching removes that delegation by requiring something the attacker cannot supply.
Training still matters, but training alone does not fix a prompt that offers approve or deny and nothing else.
What to take away
Number matching is the highest-value change available for push-based MFA, and it is a configuration change rather than a project. Pair it with prompt context, a rate limit on repeated pushes, and a user-reporting path, then alert on denials and bursts. The signal that an attacker holds a valid password is not a failed login. It is a push notification that a user rejected.
Top comments (0)