Blog

Approve, approve, approve: why "MFA fatigue" works and how number matching stops it

26 October 2026 · 2 min read

Multifactor authentication (MFA) is one of the best protections an email account can have. But one popular kind, the push notification where your phone simply asks "Approve sign-in?", has a weakness attackers learned to exploit.

What MFA fatigue is

The attacker already has your password, perhaps from a phishing page or an old data breach. They try to sign in, and your phone shows an approval prompt. You deny it. They try again. And again. Late at night, during a meeting, twenty times in a row.

Eventually someone taps Approve, just to make it stop, or because they assume IT is doing something. That one tap gives the attacker the account. Security teams call it MFA fatigue or push bombing. Sometimes the attacker adds a call or message pretending to be IT support: "We're fixing your account, please accept the prompt."

Why number matching changes everything

With number matching, the sign-in screen shows a two-digit number, and you must type that number into your authenticator app to approve. The attacker sees that number on *their* screen, not yours. So a random prompt on your phone can't be approved by accident or out of frustration: you simply don't have the number.

Microsoft enables number matching by default for Microsoft Authenticator, and recommends also showing additional context in the prompt (which app is asking, and from roughly where). Microsoft has reported that number matching plus additional context eliminated MFA fatigue attacks in the environments where it measured them. Microsoft also suppresses some push notifications for sign-ins it considers risky.

What to do

For everyone:

• If you get an approval request you didn't start, deny it and tell IT. It means someone has your password.
• Change that password from a device you trust.
• No genuine IT person will ever ask you to approve a prompt you didn't trigger.

For whoever manages Microsoft 365 or Google Workspace:

• make sure number matching and additional context are on;
• move towards phishing-resistant sign-in (passkeys or security keys) for administrators and finance staff first;
• watch for repeated failed MFA attempts: they mean a password is already in someone else's hands.

How KnoxDefender fits

Most MFA fatigue starts with a stolen password, and most stolen passwords start with a phishing email. KnoxDefender stops and explains those emails before they reach people, and its "MFA and approval-fatigue attacks" course teaches staff that an unexpected prompt is an alarm, not a nuisance.

Sources

• Microsoft Entra blog: Defend your users from MFA fatigue attacks
• Microsoft Learn: Protecting authentication methods in Microsoft Entra ID

← All stories · Questions? Contact us.