Lesson 10 of 10 · About 4 minutes
Stop an MFA fatigue attack
Learn the concept.
Repeated sign-in approval prompts can pressure someone into accepting a request they did not start. Treat unexpected prompts as a signal to stop and verify.
Interrupt the fatigue attempt
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- Recognize the mismatch
Sam did not initiate a sign-in. Repeated prompts are not a reason to approve.
- Deny and report
Sam denies the prompt and independently contacts the known support route.
- Check for successful access
Authorized responders examine prompts, approvals, and related sessions, including any accidental approval.
- Contain and strengthen
Responders select containment under the playbook and review stronger MFA and recovery protections.
Break the pressure cycle
A fictional training example. Compare the observation with the conclusion.
- PromptYou did not start a sign-in
Deny the unexpected request.
- PressureA caller asks you to approve
End the call; use a known support route.
- ResponseThe help desk investigates
Report any approval and follow the response plan.
Read the visualUnexpected prompts keep arriving and a caller asks you to approve one. What should you do?
The caller and prompts do not verify each other. Deny and report through an independent trusted route.
Do not approve to make it stop
Deny an unexpected request and use the organization’s trusted reporting route. Do not share a code or follow instructions from a caller claiming the prompts are a test.
Investigate the sequence
Responders review the account, prompts, approvals, and related sign-in and session activity. If a request was approved accidentally, report it immediately so authorized responders can assess and contain access.
Improve the sign-in method
Phishing-resistant MFA is the stronger target. Number matching can reduce push fatigue risk where that is not yet available, but it is not itself phishing-resistant. Recovery routes need protection too.
Put it in context
Fictional case: Sam gets six prompts while watching television. A caller claiming to be support asks Sam to approve the next one. Sam denies it and contacts the known help desk independently. The responder checks for any successful session; denied prompts alone do not establish whether other access succeeded.
Make a decision.
Use what you just learned. A correct answer lets you save this lesson to your progress.
Take this with you.
Approve only a sign-in you initiated and recognize. Unexpected prompts deserve a report.
Continue to the guided exercisesSee it in a Short.
Optional video companions from MyCyberTutor. Your lesson progress stays here.