Preventing MFA fatigue attacks

Who should read this?

All Employees, Cyber Security Managers, IT and Security Team

MFA fatigue attacks are a form of social engineering that exploit individuals’ patience and attentiveness while using Multi-Factor Authentication (MFA) systems. It is a tactic where attackers overwhelm users with repeated MFA requests. This can lead to users unintentionally approving a request, granting attackers access to their accounts.

Why are MFA fatigue attacks so common?

MFA fatigue attacks are increasingly common because they are highly effective. When users receive multiple notifications, they are likely to click on a link, either accidentally or because they assume it’s a technical glitch. These attacks exploit a key vulnerability in many MFA systems: there is often no control over where the login occurs or who clicks the notification link. Another reason for the prevalence of these attacks is that they are easy to automate, allowing attackers to flood numerous targets with notifications quickly, increasing the chances that someone will click and grant access.

The role of the organization in preventing MFA fatigue attacks

Here are key security practices that the IT and Security Team can implement to prevent MFA fatigue attacks within an organization.

Limit the number of MFA notifications: Restrict the number of MFA notifications a user can receive within a specific timeframe. This measure helps prevent prompt bombing, reducing the chances of threat actors overwhelming users with multiple MFA requests.
Integrate a web authenticator: Consider adding a web authenticator for enhanced MFA security. If your applications and devices are compatible, this provides one of the highest levels of protection against unauthorized access.
Modify or disable MFA notifications: Modifying or disable simple MFA push notifications. Instead of using prompts that require just a “yes” response, switch to more secure methods like challenge-response or time-based one-time passwords (TOTP).
Provide security awareness training: Ensure that security awareness training includes information about MFA fatigue attacks. Educating users on this threat helps them recognize and respond appropriately to suspicious MFA prompts.

Way forward

Preventing MFA fatigue attacks demands clear strategies and effective practices from both the organization and its employees. To help with this, Security Quotient’s research team has developed an informative carousel. This guide offers practical insights for all employees to strengthen defenses against MFA fatigue attacks.

Free carousel