BeCuriouzLearn something new every day
Your 2FA can be defeated by simply annoying you
💡 MFA that only asks you to tap "approve" can be beaten by spamming you until you cave — number matching and passkeys close that gap.
You did everything right: strong password, two-factor authentication turned on. So how do attackers still get in? A technique called MFA fatigue (also known as push bombing) skips cracking anything and targets you instead. Once a criminal has your password — from a breach or a phishing page — they try to log in over and over, firing off a stream of "Approve this sign-in?" push notifications to your phone.
The attack is pure psychology. At 3 a.m., after the tenth buzz, a tired or confused user often taps Approve just to make the noise stop — or assumes it's a glitch in their own app. Sometimes the attacker sends one prompt, then calls pretending to be IT support: "We're fixing your account, please approve the notification we just sent." That one tap hands over full access. Several major companies have been breached exactly this way.
The defense is number matching. Instead of a plain yes/no prompt, the login screen shows a two-digit number that you must type into your phone to approve. An attacker triggering the login can't see that number, so no amount of spamming helps — you'd have nothing to enter. The broader lesson: never approve a prompt you didn't personally start, and treat an unexpected flood of them as an alarm, not an annoyance. Phishing-resistant methods like hardware security keys and passkeys sidestep the problem entirely, since there's no prompt to tap.