MFA Fatigue in 2026: Why Attackers Now Spam Push Prompts and Call Your Help Desk Instead of Cracking Passwords, What Number Matching Actually Stops, and How to Verify a Caller Before Resetting Anyone’s MFA
- Internet Pros Team
- November 13, 2026
- Networking & Security
It is 11:40 at night and an employee’s phone buzzes with a sign-in approval request. They deny it. It buzzes again, and again, forty times in ten minutes. Then a message arrives from someone claiming to be IT: “We are fixing a sync problem, just approve the next one and it will stop.” They approve it. The attacker, who already had the password, is now inside. That is MFA fatigue, also called push bombing, and its quieter sibling is even more effective: skip the employee entirely and phone the help desk pretending to be them, asking for a password and MFA reset. Neither attack breaks any cryptography. Both break process.
Why Attackers Stopped Fighting MFA and Started Asking Around It
Multi-factor authentication works. It blocks the overwhelming majority of password-only attacks, which is exactly why attackers changed tactics. Stolen passwords are cheap and plentiful thanks to breaches and infostealer malware, so the password is rarely the hard part. The second factor is. And the easiest way past a second factor is a human who can approve it or reset it.
The pattern is well documented. In 2022 an attacker reached Uber’s internal systems after repeatedly pushing MFA prompts to a contractor and then messaging them as “IT support”. The 2023 MGM Resorts incident was widely reported to have started with a phone call to the help desk. The group tracked as Scattered Spider built a reputation on exactly this playbook, and in 2025 the same style of help desk impersonation was linked to disruptive attacks on major UK retailers. None of these needed a zero-day. They needed a convincing voice and a support process that valued speed over verification.
Your MFA is only as strong as the easiest way to get it reset.
The Two Attacks, Side by Side
| Push bombing (MFA fatigue) | Help desk reset fraud | |
|---|---|---|
| What the attacker needs first | A valid password | A name, job title and a few personal details, often from LinkedIn or a data broker |
| Who gets tricked | The employee, who taps Approve to make it stop | The help desk agent, who wants to unblock a stressed “colleague” |
| What the attacker walks away with | One authenticated session | A new password and their own device registered as the MFA method |
| How visible it is | Noisy: dozens of denied prompts in the logs | Quiet: it looks like a normal support ticket |
| Main fix | Number matching, then phishing-resistant MFA | Strict caller verification and a callback rule |
Help desk fraud is the more dangerous of the two. A push-bombed session can be short-lived, but a reset hands the attacker durable control of the account, and it often defeats even strong MFA, because the strong factor is the thing being replaced.
What Number Matching Actually Stops
The classic push prompt asked a yes-or-no question, and a tired person will eventually say yes. Number matching changes that. The sign-in screen shows a two-digit number, and the user must type that number into the authenticator app. Microsoft made number matching mandatory for Microsoft Authenticator push notifications in 2023, and Okta Verify, Duo and Google offer similar challenges.
- It stops blind approvals. A person in bed cannot approve a prompt without seeing the login screen, which the attacker has and they do not.
- It does not stop a coached victim. If the attacker phones the employee and says “read me the number you see”, or “type 47 into the app”, the protection is gone.
- It does not stop phishing proxies. On a fake login page that relays everything to the real one, the victim sees a real number and types it in willingly.
- It does nothing for help desk resets. The attacker never needed the victim’s approval in the first place.
Add the app context features too: showing the sign-in location and application on the prompt gives users a second clue that something is wrong. And set a limit on denied prompts, so that repeated rejections lock the method and alert security instead of letting the barrage continue.
The Real Fix: Factors That Cannot Be Approved by Accident
Phishing-resistant MFA, meaning FIDO2 security keys, passkeys and Windows Hello for Business, removes the approve button entirely. The credential is bound to the real website and the user’s nearby device, so there is nothing to bomb and nothing a caller can talk someone into reading aloud. Prioritise it for administrators, finance staff, executives and the help desk team itself, because those are the accounts attackers impersonate or target first.
Even then, account recovery remains the soft spot. A passkey is useless to an attacker who can persuade someone to delete it and register a new one. That is why the help desk process matters as much as the technology.
A Help Desk Verification Policy That Holds Up
- Never verify with facts an attacker can look up. Employee ID, date of birth, manager’s name and start date are all findable. Retire them as proof of identity.
- Call back on a number from the directory, never the number the caller gives you or the one on caller ID, which can be spoofed.
- Verify through a second channel: a live video call with photo ID, a code pushed to an already-registered device, or confirmation from the person’s manager over a known channel.
- Raise the bar for privileged accounts. Admin and finance resets should require two people to approve, or an in-person visit.
- Issue time-limited setup codes, such as Microsoft Entra’s Temporary Access Pass, instead of disabling MFA or reading out a password.
- Notify the real user by email and on their existing devices whenever their MFA method changes, so a fraudulent reset is noticed in minutes, not weeks.
- Give agents permission to say no. Urgency, anger and claims of seniority are the attacker’s tools. A policy that protects agents who slow down is a security control.
Watch for the Signals
Both attacks leave traces if someone looks. Alert on bursts of denied or ignored MFA prompts for one user, on new MFA methods registered shortly after a password reset, and on sign-ins from a new device or country within an hour of a help desk ticket. Conditional access policies can require a compliant, company-managed device for sensitive apps, so even a successful reset does not let an attacker in from their own laptop. Finally, teach staff one simple rule: an MFA prompt you did not trigger means your password is already known. Deny it, then report it, and change the password.
The Bottom Line
MFA fatigue and help desk impersonation succeed because they target people under pressure, not technology. Turn on number matching and denial limits today, move your most valuable accounts to phishing-resistant MFA, and rewrite your reset process so that no one can take over an account just by sounding convincing on the phone. The attacker only has to find one helpful person. Your process should make helpfulness safe.
Internet Pros helps businesses harden Microsoft 365 and Google Workspace sign-in, deploy passkeys and security keys, and design help desk verification procedures that stop social engineering. Contact us to schedule an identity security review.
