MFA fatigue: number matching, additional context and what comes next
The attacker has the password. All they need is for the MFA notification to be approved. So they trigger dozens of requests, sometimes in the middle of the night, sometimes alongside a call pretending to be the helpdesk, until the user gives in out of weariness. This is MFA fatigue, and awareness training alone will not stop it.
How the attack works
MFA fatigue, or push bombing, targets methods where the user only has to tap "Approve". It assumes the attacker already knows the password, obtained through phishing, reuse or a data leak. Every sign-in attempt triggers a notification on the victim's phone, and a single approval, deliberate or accidental, is enough for the attacker to get a session.
One point is often overlooked: if a user receives MFA requests they did not initiate, their password is compromised. The response therefore cannot stop at denying the notification.
Number matching
For Microsoft Authenticator notifications, number matching is now enforced by Microsoft. The sign-in screen shows a number that the user must type into the app to approve. A reflexive tap is no longer enough: the user has to see the sign-in screen, which defeats most blind bombing.
It is not complete protection. If the attacker calls the victim posing as the helpdesk and reads out the number, or uses a phishing proxy that displays the real sign-in page, number matching will not stop them.
Additional context
Authenticator can show the name of the requesting application and the estimated geographic location of the sign-in in the notification. A user in London who sees a request coming from another continent has a concrete reason to deny it. These options are configured in the authentication methods policy; make sure they are enabled for all users rather than left at the Microsoft-managed value without review.
Making use of user reports
The "Report suspicious activity" feature lets users flag, from the notification or the call, that they did not initiate the request. The report is logged and, with Microsoft Entra ID Protection, raises the user's risk. Combined with a Conditional Access policy based on user risk, it can force a secure password change or block access.
Close the loop. A report that leads to no action discourages users from reporting again. Define who handles these alerts and how quickly, and make sure the password is always reset.
Aim for phishing-resistant methods
Number matching fixes a weakness of push notifications but does not make them phishing resistant. Methods bound to the origin domain, such as passkeys (FIDO2), whether on a hardware key or in Authenticator, Windows Hello for Business or certificate-based authentication, defeat both push bombing and phishing proxies. A sensible path is to:
- require these methods for administrators first, using Conditional Access authentication strengths;
- then roll them out to exposed groups: executives, finance, helpdesk;
- gradually reduce the use of weaker methods, starting with SMS and voice calls.
What an audit checks
- The authentication methods enabled and how they are actually spread across users.
- Whether additional context is enabled in Authenticator notifications.
- The configuration of "Report suspicious activity" and how reports are handled.
- User risk policies and their remediation action.
- Phishing-resistant methods being required for privileged accounts.