Multi-factor authentication (MFA) has become a standard defense across the financial sector. Attackers have adapted. Instead of trying to break MFA, many now try to wear down the person using it. This tactic, known as MFA fatigue, is especially dangerous when aimed at bank executives with broad system access. For institutions that rely on managed IT for banks or run security in-house, understanding how these attacks work is the first step toward stopping them.
What Is an MFA Fatigue Attack?
An MFA fatigue attack starts after a criminal has already obtained a user’s password. Passwords are often stolen through phishing, data breaches, or malware. The attacker then tries to log in again and again, which triggers a stream of push notifications on the victim’s phone.
The goal is simple: frustration or confusion. After dozens of prompts, often late at night, a tired or distracted user may tap “Approve” just to make the alerts stop. That single tap gives the attacker full access.
How Push Notification Bombing Works
Push notification bombing, sometimes called prompt bombing, depends on volume and timing. Attackers may send prompts in rapid bursts or spread them over hours to create a sense of system malfunction. Many choose early mornings, weekends, or travel periods, when executives are less alert.
Social Engineering Makes It Worse
Push bombing rarely works alone. Attackers often pair it with social engineering to make approval feel legitimate. Common tactics include:
- Fake IT support calls or texts claiming the prompts will stop once the user approves one
- Urgent messages tied to wire transfers, board meetings, or regulatory deadlines
- Impersonation of colleagues using details gathered from LinkedIn or press releases
Executives receive frequent requests that seem urgent, so a well-timed, believable message can override caution.
Why Bank Executives Are High-Value Targets
Executives hold the keys to an institution’s most sensitive assets. Their accounts may provide access to wire approval systems, core banking platforms, customer financial data, and strategic documents.
Several factors raise their risk:
- Public visibility, which makes it easy to find names, email formats, and schedules
- Elevated privileges that let attackers move quickly once inside
- Busy, mobile work habits that encourage fast approvals on phones
- Authority, since requests sent from an executive account are rarely questioned
A single compromised executive account can lead to fraudulent transfers, business email compromise, or ransomware deployment.
How Financial Institutions Can Defend Against MFA Fatigue
The strongest defenses remove the chance for a careless approval. Banks should consider these countermeasures.
Enable Number Matching
Number matching requires users to enter a code shown on the login screen into their authenticator app. Because the attacker controls the login screen, the victim can’t approve a request blindly. Microsoft now enforces number matching in Authenticator push notifications for this reason.
Move to Phishing-Resistant MFA
FIDO2 security keys and passkeys use cryptographic verification tied to the legitimate website. They don’t rely on push approvals, and they can’t be phished or relayed. CISA recommends phishing-resistant MFA as the strongest option, particularly for privileged users like executives.
Limit and Monitor Push Requests
Set thresholds that block or flag repeated MFA prompts within a short window. Security teams should treat a sudden spike in denied requests as a sign of a stolen password and reset credentials immediately.
Train Executives Specifically
General awareness training often misses executive risk. Short, targeted sessions should teach leaders to:
- Never approve a prompt they didn’t initiate
- Report unexpected MFA requests right away
- Verify any “IT support” contact through a known channel
Stopping MFA Fatigue Before It Starts
MFA fatigue exploits human behavior rather than technical flaws, which is why it works so well against busy, high-profile bank leaders. Push bombing and social engineering together create pressure that can lead to a single costly mistake. Financial institutions that adopt number matching, phishing-resistant authentication, prompt monitoring, and executive-focused training remove much of that pressure. The result is an MFA program that protects the institution even when attackers already have a password.
