The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The safest way to stop MFA fatigue attacks is to replace ordinary push approvals with phishing-resistant sign-in methods wherever possible. Use a FIDO2/WebAuthn security key or passkey first; if a service only supports an authenticator app, turn on number matching and approve requests only when you started the sign-in yourself. Deny every unexpected prompt, then investigate the account through its official website or app.
MFA (multi-factor authentication) still protects an account even when a password has been stolen, but the method matters. A passkey or security key is designed to resist phishing. Number matching makes accidental push approval harder, but it is an interim control rather than a phishing-proof solution.
As an Amazon Associate I earn from qualifying purchases.
What MFA fatigue and “push bombing” mean
MFA fatigue is an attack in which someone repeatedly triggers second-factor notifications on a victim’s phone or computer. The attacker usually already knows, has guessed, or has obtained the account password. They start many login attempts and rely on the flood of prompts to make the user approve one accidentally, approve it just to stop the interruptions, or assume it is a routine sign-in.
The Cybersecurity and Infrastructure Security Agency (CISA) calls this technique “push bombing.” In its October 2022 fact sheet, CISA described it this way: “MFA fatigue, also known as ‘push bombing,’ occurs when a cyber threat actor bombards a user with mobile application push notifications until the user either approves the request by accident or out of annoyance with the nonstop notifications.”
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
An unexpected prompt is therefore evidence of a possible active attack, not merely a phone glitch. Denying it prevents that particular attempt, while repeated prompts indicate that the password or another part of the sign-in flow may already be compromised.
How the attack works
- Password acquisition: The attacker obtains a password through a data breach, password reuse, malware, guessing, or a convincing phishing page.
- Repeated sign-in attempts: They enter the password against the real service, causing the service to send push requests to the account holder’s registered device.
- Pressure and confusion: Notifications arrive while the person is busy, asleep, or handling several legitimate sign-ins. The attacker may also call or message the victim pretending to be help-desk staff.
- Approval: One accidental or pressured approval completes the login. The attacker can then access mail, cloud files, payment information, administrative tools, or account-recovery settings.
- Persistence: After access, the attacker may register another authenticator, create an app password, add a recovery address, steal session cookies, or change the password.
Because the attack depends on social pressure rather than a cryptographic weakness in MFA, user behavior and the selected MFA method both matter.
Choose the strongest MFA method your account supports
CISA’s comparison ranks phishing-resistant FIDO/WebAuthn and PKI methods above app-based one-time passwords and push systems. The exact choices shown in an account depend on the provider, device, browser, operating system, and recovery configuration.
| MFA method | Protection from push fatigue | Phishing resistance | How to use it |
|---|---|---|---|
| FIDO/WebAuthn security key or passkey | Push bombing does not apply to the authentication exchange. | Phishing-resistant. | Prefer it for high-value accounts. Confirm that your devices, browsers, account, and recovery process support the key or passkey. |
| Authenticator push with number matching | CISA identifies it as resistant to push bombing because the user must match a displayed number. | Still vulnerable to phishing and real-time relay attacks. | Use it as an interim improvement when a passkey or security key is unavailable. |
| Authenticator-app one-time password (OTP) | There is no unsolicited approval button to tap. | Vulnerable to phishing if a code is entered into a fraudulent or relayed sign-in. | Enter codes only into the official site or app that you opened yourself; never disclose them to a caller or message sender. |
| Push notification without number matching | Vulnerable to push bombing and user error. | Not phishing-resistant. | Avoid it when the provider offers number matching or a stronger method. |
| SMS or voice code | It does not use an approval push, but it does not solve other account-takeover risks. | Vulnerable to phishing, SS7-related interception, and SIM-swap attacks. | Use only as a last resort when stronger methods are unavailable. |
Compare options on five practical criteria: resistance to phishing, resistance to push bombing, the accounts and devices that support the method, the recovery procedure, and the effort required to deploy it. A method that is theoretically strong but unavailable on your phone or impossible to recover from can leave you locked out.
Secure personal accounts step by step
1. Protect accounts that can unlock other accounts
Start with your primary email, password manager, financial services, mobile-carrier account, social networks, online stores, cloud storage, gaming services, and streaming services. CISA specifically recommends MFA for email, financial, social-media, online-store, gaming, and streaming accounts. Email and password-manager accounts deserve priority because they can reset many other passwords.
2. Open security settings through the real service
Type the provider’s known address yourself, use a bookmark you created previously, or open the official mobile app. Do not follow a security link from an unexpected email, text, or support message. Look for labels such as Security, Sign-in and security, Two-step verification, Multi-factor authentication, or Passkeys and security keys.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Register a passkey or security key
Choose a passkey or a FIDO2/WebAuthn security key if it is offered. A passkey may be stored on a phone, computer, or password manager and unlocked with the device’s screen lock or biometrics. A physical key is a separate device that you insert or tap. CISA’s small-business guidance names security keys such as YubiKey as an example of a strong MFA choice, but compatibility varies by account, model, connector, browser, and device.
Register at least one backup method before removing an older method. Keep a second security key in a safe place if the account supports multiple keys. Test both keys or devices in a private sign-in window before relying on them.
4. Turn on number matching when push is unavoidable
If the only practical option is an authenticator push, enable number matching in the provider’s security settings or have an administrator require it. A sign-in will display a number on the device or browser and ask you to enter or select the matching number in the authenticator app. This makes blind tapping much harder.
Number matching does not make the exchange phishing-resistant. A real-time phishing site can still relay the sign-in and persuade you to enter the number. Treat it as a safer fallback than a bare approve/deny prompt, not as permission to approve unfamiliar requests.
5. Use OTP carefully
When an authenticator offers only a rotating one-time code, type it into the official service you opened yourself. Do not read the code to anyone who calls, chats, or claims to be support. A legitimate employee should not need your one-time password. OTP avoids push-bombing prompts but remains susceptible to phishing and real-time interception.
6. Review registered methods and sessions
After enabling MFA, inspect the account’s list of authenticators, security keys, recovery addresses, phone numbers, active sessions, remembered devices, app passwords, and third-party applications. Remove entries you do not recognize. A stolen password is not the only concern: an attacker who already entered the account may have added a lasting method.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
7. Secure recovery before you need it
Confirm that the recovery email and phone number belong to you and are themselves protected by strong MFA. Generate backup codes if the provider offers them, store them offline in a secure place, and treat each code like a password. Do not keep all recovery methods on the same lost or compromised device.
8. Update your devices and authenticator
Install security updates for the phone, computer, browser, and authenticator application. Use a device screen lock, and do not leave an unlocked phone where another person can approve a request. Updates cannot stop a socially engineered approval by themselves, but they reduce separate paths to account compromise.
9. Make approval rules explicit
Adopt a simple rule: you approve an MFA request only when you initiated the login within the last few seconds and the displayed service, device, and location make sense. If you are not actively signing in, deny the request. Never approve first and investigate later.
Free tools Windows power users keep installed
One-click scans. No signup required.
10. Rehearse the recovery path
Know where the provider’s account-recovery page is, how to revoke sessions, and how to contact official support. Test that backup codes and a second registered method work while you are still signed in. Do not wait until a lost phone or suspected takeover makes every recovery step harder.
What to do when an unexpected prompt appears
- Deny the request. Do not tap approve merely to silence it.
- Capture useful details. Note the displayed number, approximate time, device, location, and service name if the prompt shows them. Do not screenshot or share a one-time code if that could expose it.
- Stop interacting with the suspicious message. Do not call a number in a text, reply to a supposed support agent, or open a link that accompanied the notification.
- Change the password through the official service. Use a clean, trusted device if you suspect the current device is infected. Choose a unique password that is not used anywhere else.
- Review sign-in history and account changes. Look for unfamiliar locations, devices, sessions, recovery methods, app passwords, forwarding rules, and connected applications.
- Revoke access you do not recognize. Sign out unknown sessions, remove unknown authenticators, delete unfamiliar app passwords, and disconnect suspicious third-party applications.
- Contact official support or your organization’s security team. Use the support address shown inside the legitimate account or on the provider’s known website.
- Check other accounts. If the password was reused, change it everywhere and prioritize accounts that use the same recovery email or phone.
If you approved a prompt by mistake, treat the account as potentially compromised even if nothing looks wrong. Change the password, revoke sessions, inspect recovery settings, and report the incident promptly. An attacker may have created persistence that is not obvious on the first screen.
Provider-specific details to verify
Microsoft Entra and Microsoft Authenticator
Microsoft documents number matching for Authenticator push notifications in supported Microsoft Entra scenarios. It does not support number matching for push notifications delivered to Apple Watch or Android wearable devices. Microsoft also documents a same-device experience in some Microsoft mobile apps where the user can reply Yes or No under specified conditions; browser sign-ins continue to require entering the displayed number. Because support depends on the sign-in path and platform, verify the current behavior before writing internal instructions.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Administrators introducing a Conditional Access policy that requires phishing-resistant MFA for administrator roles should first confirm that every administrator has registered an appropriate method. Microsoft warns that enforcing the policy before registration can lock tenant administrators out. Test emergency-access accounts and the recovery procedure before broad enforcement.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallGoogle Accounts
Google describes passkeys and hardware security keys as phishing-protective choices. Google prompts are an alternative second step for people who are not signing in with a passkey. The exact controls shown in a Google Account depend on the account type, device, and current rollout, so open the account’s own Security page and verify which methods are registered rather than assuming that another Google account has identical options.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Guidance for organizations and administrators
Set a risk-based order
Require MFA for administrators, remote access, email, cloud consoles, financial systems, and people handling sensitive data first. Extend coverage to the rest of the workforce and external users as the platform supports it. CISA recommends starting with administrators and users who handle sensitive information.
Prefer phishing-resistant enrollment
Make passkeys, FIDO2/WebAuthn security keys, or suitable PKI credentials the target state for privileged and high-value accounts. Provide compatible hardware, enrollment time, and a tested replacement process. Do not remove every fallback until users have a working primary method and a secure recovery route.
Use number matching as an interim control
Where phishing-resistant methods are not yet available, require number matching instead of a simple approve/deny push. Explain that the feature reduces push bombing but does not defeat a convincing phishing relay. Do not describe it to employees as “phishing-proof.”
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Train and support the deny rule
Tell employees that an unrequested prompt must be denied, not approved or ignored. Give them one clear channel for reporting repeated prompts, and ensure the help desk never asks for a password, OTP, or approval. Track reports as possible credential compromise rather than dismissing them as notification problems.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Protect emergency access
Before applying a policy, test administrator enrollment, emergency-access accounts, break-glass procedures, backup keys, and support escalation. Record who can disable a mistaken policy and how that person is reached when normal sign-in is unavailable.
Monitor signals beyond approvals
Alert on bursts of denied prompts, sign-ins from unusual locations, new authenticators, recovery changes, impossible travel, unfamiliar devices, and newly created app passwords. A denied prompt is useful telemetry: it may be the first indication that a password has leaked.
Common mistakes and their fixes
| Mistake | Why it is dangerous | Better practice |
|---|---|---|
| Approving a prompt to stop notifications | It gives the attacker the second factor they need. | Deny it, then investigate the account through the official service. |
| Assuming number matching is phishing-resistant | A relay attack can still trick a user into entering the displayed number. | Use a passkey or security key where available; treat number matching as an interim measure. |
| Reading an OTP to “support” | The caller can use it immediately to complete a login. | Keep every code private and type it only into the official sign-in page. |
| Keeping SMS as the preferred method | SMS and voice are exposed to phishing, SIM swaps, and SS7-related attacks. | Move to FIDO/WebAuthn, then authenticator methods, and retain SMS only when necessary. |
| Enforcing stronger MFA before enrollment | Administrators or users may be locked out. | Register methods, test recovery, and then enforce the policy in stages. |
| Ignoring recovery settings | An attacker may use a recovery address, phone, or backup code to regain access. | Review and protect every recovery path with the same care as the primary login. |
| Registering only one device | A lost, broken, or replaced device can become an account outage. | Maintain a tested backup key, passkey, or recovery method. |
A concise account-hardening checklist
- Enable MFA on email, financial, social, shopping, cloud, gaming, and streaming accounts.
- Choose a passkey or FIDO2/WebAuthn security key when the provider supports it.
- Use a unique password and a password manager for each account.
- Enable number matching when push is the only practical option.
- Deny every prompt you did not initiate.
- Never disclose passwords, OTPs, backup codes, or approval numbers.
- Review sessions, devices, authenticators, app passwords, recovery methods, and connected apps.
- Store backup codes and a spare security key securely.
- Keep phones, computers, browsers, and authenticator apps updated.
- Know the provider’s official recovery and support route before an incident.
What the available evidence does—and does not—show
CISA’s guidance establishes the relative security properties of the methods: FIDO/WebAuthn and PKI are phishing-resistant; number matching mitigates push bombing but remains phishable; ordinary push, OTP, SMS, and voice have important weaknesses. Availability is provider- and device-dependent.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft reports that 92% of its employee productivity accounts are protected by phishing-resistant authentication methods. Microsoft does not state a year for that figure on the cited page, and it describes Microsoft’s own employee accounts—not the general population—so it should not be used as a prevalence estimate for MFA fatigue or as proof that one control works everywhere.
No independent, topic-wide statistic establishes how often MFA fatigue occurs or assigns a universal success rate to each defense. The practical response is therefore to use the strongest supported method, treat unexpected prompts as incidents, and verify the current account controls before relying on them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
