Push fatigue: the prompt is not the control
Attackers don't break MFA — they ask the user to approve it, over and over, until someone taps yes at 11 p.m. Here's how to close that gap.
Multi-factor authentication is still one of the best controls you can deploy. But the most common way it fails has nothing to do with cryptography: the attacker already has the password, triggers a push notification, and keeps triggering it until a tired person approves one just to make it stop. This is push fatigue, and it is behind a long list of public breaches.
What actually happens
The sequence is depressingly consistent. Credentials are phished or reused from an old leak. The attacker logs in, the victim's phone buzzes, they deny it. It buzzes again. And again. Sometimes the attacker follows up on chat or email pretending to be IT. Eventually one push gets approved — and from the logs' point of view, that login looks legitimate.
What to do about it
- Turn on number matching. The user types a number shown on the login screen instead of tapping approve. They can't approve a login they can't see, which kills blind push approval.
- Rate-limit and alert on denials. Six denied pushes followed by an approval is not a success story — it's an incident. Treat that sequence as a detection, not a footnote.
- Watch what happens next. A fatigued approval is often followed by a new device enrollment or a broad OAuth grant. Correlate the login with the next ten minutes of activity.
- Tell your people it's fine to report. "I kept getting prompts and finally approved one" should be a five-minute fix, not a career event.
The deeper lesson: MFA is a signal, not a verdict. The approval matters less than the pattern around it — the denials before it, the geography, the device, the hour. That's the pattern BlackPing's identity detection reads automatically, so the one weird approval in ten thousand gets a human's attention instead of blending in.