MFA fatigue and SIM swapping target different parts of multifactor authentication. Push bombing tries to wear a person down until they approve a sign-in they did not start; a SIM swap aims to take control of their phone number so an attacker can receive SMS or voice codes. The strongest practical defense is to prioritize phishing-resistant MFA where a service supports it. If push approval remains in use, number matching can reduce fatigue risk, but it is an interim measure—not an equivalent substitute.
What is an MFA fatigue attack?
An MFA fatigue attack, also called push bombing or push fatigue, is an approval attack. An attacker triggers repeated sign-in approval requests, hoping the account holder will approve one accidentally, mistake it for a legitimate request, or accept it simply to stop the interruptions. CISA describes the technique in its phishing-resistant MFA fact sheet, and a joint government advisory published October 16, 2024 describes threat actors using it in observed intrusions.
As an Amazon Associate I earn from qualifying purchases.
The attacker typically has or is testing a password, or otherwise initiates authentication attempts that prompt approvals. But unsolicited prompts alone do not prove that a password has been compromised. They are a warning to refuse the request and use the organization’s established reporting channel.
Recommended Free Tools
What is push bombing?
Push bombing is another name for MFA fatigue: the attacker repeatedly sends push-notification approval requests to pressure the user. The weakness is not that a push notification automatically defeats MFA; it is that repeated requests can turn a security decision into a rushed or mistaken tap.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft’s Digital Defense Report 2022 cited Azure AD Identity Protection telemetry estimating 30,000 MFA fatigue attacks per month. Its monthly table listed 37,000 instances in June 2022. These are historical Microsoft estimates, not a current global attack rate. The cited sources do not establish a current, independently measured worldwide prevalence figure for MFA fatigue or SIM swapping.
Can a SIM swap bypass two-factor authentication?
It can undermine two-factor authentication when the second factor is a code delivered by SMS or voice. In a SIM swap, an attacker socially engineers a mobile carrier into transferring the victim’s phone number to an attacker-controlled SIM. The attacker may then receive verification codes sent to that number. CISA also identifies exploitation of SS7 protocol vulnerabilities as a separate route by which SMS or voice codes may be obtained.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
This differs from push bombing: a SIM swap targets control of a phone number, while push bombing pressures a person to approve a sign-in. Neither means that every account using MFA is automatically exposed, but SMS and voice codes have risks that phishing-resistant methods are designed to address more effectively.
How these attacks differ from phishing and adversary-in-the-middle attacks
- MFA fatigue or push bombing: Repeated approval requests pressure the user to authorize an authentication they did not initiate.
- SIM swapping: A carrier is manipulated into transferring a phone number, potentially exposing codes sent by SMS or voice.
- Phishing: A user is tricked into entering a password and one-time code on an imitation sign-in page.
- Adversary-in-the-middle phishing: An attacker relays sign-in interactions or captures authentication tokens, potentially defeating methods that are not bound to the legitimate service.
These are distinct paths, but they point to the same caution: enabling MFA does not mean every MFA method resists every attack. CISA warns that some forms are vulnerable to phishing, push bombing, SS7 exploitation, or SIM swaps. NIST defines phishing resistance in terms of whether an authentication protocol prevents an impostor verifier from obtaining authentication secrets or valid outputs without relying on the user to spot the fraud.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which MFA defenses are strongest?
CISA calls phishing-resistant MFA the preferred direction and recommends making migration to it a high priority. NIST’s definition explains why: the protocol should prevent secrets or valid authenticator outputs from being disclosed to an impostor verifier without depending on the user’s vigilance. Options include FIDO2 security keys and other phishing-resistant methods supported by the service.
| Option | What it helps against | Important limitation |
|---|---|---|
| FIDO2 security key or another phishing-resistant method | Impostor-verifier phishing; CISA identifies phishing-resistant MFA as the preferred direction. | Confirm service support and plan enrollment, backup, and account recovery. No method prevents every account compromise. |
| Push approval with number matching | Reduces the simple fatigue pattern of approving a request just to stop repeated prompts. | CISA recommends it as an interim mitigation when phishing-resistant MFA cannot yet be implemented, and says it is not as strong. |
| SMS or voice one-time code | Adds a second factor compared with password-only access. | Codes may be exposed through SIM swapping or SS7-related interception. |
| Push approval without number matching | Provides an approval-based sign-in flow. | Exposed to the fatigue and user-error pressure described by CISA and the 2024 joint advisory. |
A FIDO2 security key is a physical product category, not a universal compatibility guarantee. Check that the particular account supports it, and decide how to handle a backup key or account recovery before making it your only sign-in route.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do I stop MFA push notifications I didn’t request?
- Decline every request you did not initiate. Do not approve one to clear the notifications or assume that repeated requests are legitimate.
- Report the prompts through your organization’s established help desk or security process. If this is a work account, follow its incident-reporting procedure rather than relying on dismissal alone.
- Use a trusted route to check the account if you suspect access. Ask the organization’s security team to review sign-ins, registered authentication methods, recovery paths, and active sessions under its incident-response procedures.
- Ask whether number matching or phishing-resistant MFA is available. Number matching can reduce push-fatigue risk while a stronger method is unavailable; prioritize a phishing-resistant option when the service supports one.
Do not treat a burst of prompts as proof that the attacker has logged in. But do not treat dismissing them as proof that the account is safe, either. In confirmed compromises described by the 2024 joint advisory, actors used access to register an MFA device they controlled. That makes review of authentication methods and sessions important when compromise is suspected.
How to reduce risk from SMS and voice codes
For high-risk accounts, reduce reliance on SMS or voice codes where a suitable phishing-resistant method is available. CISA’s guidance identifies both SIM swapping and SS7 exploitation as threats to those channels. Carrier protections and recovery procedures vary, so check the options available from your carrier and the service rather than assuming a particular account PIN or port-control feature is universally offered or sufficient.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What the official guidance says
CISA’s October 2022 Implementing Phishing-Resistant MFA says that any MFA is better than none, while calling phishing-resistant MFA the gold standard and urging organizations to prioritize migration. In its October 31, 2022 announcement, CISA recommended number matching to mitigate fatigue when an organization using push notifications cannot implement phishing-resistant MFA.
NIST’s SP 800-63-4 authenticator guidance defines phishing resistance around preventing an impostor verifier from receiving secrets or valid authenticator outputs without depending on user vigilance. Its threats and security considerations also address authentication-fatigue concerns. These principles explain why number matching is a useful improvement over simple push approval, but not the same security property as phishing resistance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
