2FA Fatigue
Noun · Hacker Culture
Definitions
The frustration or desensitization users experience from repeated two-factor authentication prompts, which can lead them to approve push notifications without verifying legitimacy — a behavior actively exploited by attackers who spam MFA prompts until the target hits 'Approve' out of annoyance (also called MFA bombing or prompt bombing).
In plain English: When people get so tired of constant login verification pop-ups that they start approving them without thinking, which hackers can exploit.
Example: "The Uber breach happened because the attacker just kept spamming push notifications until the contractor approved one out of 2FA fatigue."
Etymology
- 2011
- Two-factor authentication began widespread consumer adoption through Google Authenticator and SMS-based verification, adding a second layer beyond passwords.
- 2018
- Push-based 2FA (approve/deny prompts on phones) became popular via Duo and Microsoft Authenticator, trading code entry for a simpler tap to approve.
- 2022
- The Uber and Cisco breaches demonstrated 'MFA fatigue' attacks, where attackers spammed push notifications until the target approved one out of frustration or confusion.
- 2023
- The industry responded with number-matching and phishing-resistant standards (FIDO2/passkeys). '2FA fatigue' entered the security lexicon as a recognized social engineering vector.
Origin Story
When Security Prompts Become Their Own Vulnerability
2FA fatigue, also known as MFA fatigue or prompt bombing, is a social engineering attack where an adversary repeatedly triggers two-factor authentication push notifications on a victim's device, hoping the target will eventually approve one just to make the alerts stop. The technique gained widespread attention in September 2022 when a teenage hacker from the Lapsus$ group used it to breach Uber's internal systems. The attacker obtained an employee's credentials and then bombarded them with Duo push notifications over several hours, eventually contacting the victim on WhatsApp while posing as IT support and convincing them to approve the request. This incident exposed a fundamental weakness in push-based 2FA: the assumption that users will carefully evaluate every prompt. In practice, notification overload leads to reflexive approval, especially outside business hours or during busy periods. The attack prompted a wave of changes across the industry. Microsoft, Okta, and Duo all introduced 'number matching' requirements, where users must type a code displayed on the login screen rather than simply tapping 'Approve.' The technique demonstrated that security is only as strong as the humans interacting with it.
Context: The term emerged in cybersecurity circles around 2022 following high-profile breaches exploiting push notification overload.
Fun fact: During the 2022 Uber breach, the attacker reportedly sent over 100 push notifications to the target employee in a single evening before the employee finally gave in and approved one.