Fraud How to defend against MFA fatigue attacks

MFA fatigue—also called MFA bombing or MFA spamming—is a cybersecurity fraud technique that aims to overwhelm users with verification requests. When fraudsters enter a stolen password, your MFA system sends a verification request to the target (the credential’s true owner).

If the target (your employee) approves it, the hacker gains instant access to your system. If they don’t approve it, hackers will continue bombarding employees with authentication requests for hours or even days—wearing down busy or distracted staff members until they approve a fraudulent request that gives them access to your system.

MFA fatigue succeeds by exploiting a common vulnerability of people, from CEOs to junior team members alike. The busier the user is—and the more they trust your authentication system—the more likely they are to approve one of the verification requests and compromise your network security.

Security experts are perfecting MFA defenses that don’t require passwords. Currently, federal agencies require phishing-resistant fraud prevention technology such as FIDO2 authentication.^{Disclosure 2} This approach replaces passwords with a fingerprint, face scan, or security key.

Case study: Strong security keeps planes flying and passengers safe in Hawaiian Airlines MFA fatigue breach.

Halting MFA fatigue is possible by training your staff and tightly managing the boundaries of your digital network. Here are a handful of tips that can help kickstart your efforts.

Educate team members on credential theft through social engineering fraud.

Teach colleagues how to identify and spot the telltale signs of social engineering fraud. This preemptively foils scammers’ ability to launch MFA fatigue attacks by eliminating their ability to steal staff credentials.

Raise awareness around MFA security red flags.

Make teammates aware that incessant verification requests, notifications at odd hours, and other unusual messages can be signs of a hacker’s attempted MFA attack. Even slight inconsistencies in notification behaviors should be treated as red flags—and reported immediately.

Keep security protocols tidy.
Passwords should be created following IT security standards, changed regularly, never shared, and never reused. Have your IT team consistently monitor sign-in activity to detect irregularities that could signal attacks. Also, direct employees to install updates for firmware, software, and security apps as soon as they become available.

Adjust MFA parameters.

Not all MFA security processes offer the same level of security. Consider adopting approaches that verify the user’s geolocation, increase the number of factors needed to gain network access, and limit the number of MFA attempts in a given period.

Vary your MFA methods.

Many MFA apps include verification methods less susceptible to fatigue. One example is MFA number matching, which provides users with a random string of digits generated by an authenticator app. The user must then select the correct number from several options offered by the network to avoid entry denial.

Consider implementing least privilege.

Least privilege places highly sensitive information like HR records and financial data under restricted access. With it enacted, only one or two people in an entire organization have the credential access to pull up certain information like bank account numbers. This means hackers can only get what they want by targeting a specific person, not just any employee.