← All briefings

01 / ACCOUNTS · Published · Last reviewed · By the Red Flag Cyber research desk

The login prompt you didn’t request

MFA fatigue turns one careless tap into an open door.

A phone with multi-factor authentication enabled beside a red warning flag

A burst of sign-in prompts is not a glitch to clear. It can mean someone already has your password and is trying to wear down your judgment.

What the attacker is doing

In a push-bombing attack, someone repeatedly triggers multi-factor prompts and waits for you to approve one—whether from confusion, annoyance, or habit. CISA describes push fatigue as overwhelming a user with requests until access is approved.

Your move

  1. Deny the request.Never approve a sign-in you did not start yourself.
  2. Change the account password.Use the official app or a bookmarked site, not a link in a message.
  3. Review active sessions.Sign out unfamiliar devices and check recovery email or phone details.
  4. Upgrade the second factor.If offered, choose a security key, passkey, or an authenticator with number matching.
The ruleIf you did not begin the login, you do not approve the prompt. A real sign-in can always be started again.

Primary source: CISA on phishing-resistant MFA and push fatigue ↗

Related briefings