Skip to content
Quick Answer: MFA fatigue is a social engineering attack where criminals bombard a user with repeated push notifications until they approve one out of frustration or confusion. For banks, the fix isn’t disabling multi-factor authentication. It’s reducing prompt fatigue through smarter verification methods, especially for executives who are prime targets.
If you’ve ever had your phone buzz three times in a row with “Approve Sign-In?” while you were in the middle of dinner, you already know the feeling attackers are counting on. That small spike of annoyance is exactly what fuels an MFA fatigue attack.
RESULTS Technology works with community banks across the Midwest every day, and this is one of the most common frustrations bank leaders bring to us: multi-factor authentication feels like a hassle, so why not turn it off for the people who complain the loudest?
We get the instinct. But turning off MFA, even for one executive, opens a door that’s expensive to close again. Here’s what MFA fatigue actually is, why it works, and how your bank can cut down on prompt overload without giving up protection.
What Is MFA Fatigue?
MFA fatigue (also called push bombing or MFA bombing) happens when an attacker who already has your password tries to log in repeatedly, triggering a flood of approval requests on your phone. The Cybersecurity and Infrastructure Security Agency (CISA) describes it as bombarding a user with push notifications until they approve one by accident or simply to make the noise stop.
That frustration is the whole point. Executives who are annoyed by frequent MFA prompts are, without realizing it, describing the exact vulnerability attackers are built to exploit.
How an MFA Fatigue Attack Actually Works
The attack usually unfolds in a predictable pattern:
- The attacker already has a valid password, often from a phishing email or a data breach.
- They attempt to log in, which triggers a legitimate MFA push to the real user’s device.
- They keep retrying, frequently late at night or early morning, when a half-asleep employee is more likely to tap “approve” without thinking.
- Sometimes they follow up with a phone call or text pretending to be IT support, telling the employee to approve the request to “fix” an issue.
- Eventually, the user taps approve just to stop the notifications, and the attacker is in.
No malware. No brute-force cracking. Just persistence and psychology.
Why Bank Executives Are the Accounts Attackers Want Most
Executives are high-value targets for a few specific reasons. They typically have wire approval authority, inboxes full of sensitive financial conversations, and the credibility to direct staff without much pushback.
Their names and titles are often listed publicly on the bank’s own website, making them easy to identify. And because they travel, work long hours, and have little patience for repeated prompts, they fit the exact profile an MFA fatigue attack is designed to wear down.
Turning off MFA for one executive doesn’t just expose that person. It exposes every account, wire transfer, and client record that executive can touch. This is why RESULTS requires MFA across the board for community bank clients and doesn’t make exceptions, even for the C-suite.
How to Reduce MFA Fatigue Without Turning MFA Off
Instead of fewer safeguards, banks should implement smarter choices.
- Verified push or number matching: Instead of a simple “approve/deny” tap, the user has to enter a matching number shown on their login screen. This stops accidental approvals cold.
- Fewer prompts on trusted, managed devices: Devices already verified by your IT team can require less frequent re-authentication, cutting down on prompt fatigue for everyday work.
- Phishing-resistant MFA for executives and admins: Security keys or certificate-based authentication remove the push notification entirely for your highest-risk users.
- Employee training: When staff understand what MFA is actually stopping, like account takeover and wire fraud, they tolerate the extra step far better.
What To Do if You Get an MFA Prompt You Didn’t Request
- Don’t approve it, and don’t tap anything just to make it stop.
- Report it to your IT team right away.
- Reset the password immediately. An unexpected prompt almost always means that password is already compromised.
If this sounds familiar, don’t wait for it to happen again. Request an assessment from RESULTS Technology and find out exactly where your bank’s authentication setup needs reinforcement.
A Required Control in the Banking Success Model Framework: Within RESULTS Technology’s Banking Success Model, MFA sits alongside EDR, SIEM, and Security Awareness Training as a required control. It’s a core part of the “Secure” Pillar, which is intended to reduce cybersecurity risks that are aligned with real-world threats.
Frequently Asked Questions
Does MFA need to be enabled for every bank employee, or only privileged users?
Every employee with network or system access should have MFA enabled, not just admins and executives. Attackers often target lower-level accounts first as a stepping stone to more sensitive systems.
What should you do if you accidentally approve an MFA request?
Report it to IT immediately, reset the affected password, and check recent account activity for unauthorized logins. Treat the account as compromised until proven otherwise.
Does a bank’s VPN need MFA?
Yes. VPN access is a direct line into internal systems, which makes it one of the highest-priority places to require MFA.
Can MFA be required for bank vendors and third-party users?
Yes, and it should be. Vendors and third parties with access to your systems represent the same risk as internal employees and need the same authentication standards.
