An employee is at home, perhaps watching television or getting ready for bed, when their phone buzzes with a Microsoft Authenticator prompt. They are not trying to log in, so they ignore it. A minute later, it buzzes again. Then again. After the tenth or twentieth notification, many people tap 'Approve' just to make the noise stop. This is an MFA fatigue attack, also known as push bombing, and it is currently one of the most effective ways for attackers to bypass multi-factor authentication.
Multi-factor authentication (MFA) was once considered a near-perfect defence against credential theft. If an attacker stole a password, they still could not get into the account without the physical device. However, as MFA adoption has grown, so has the sophistication of the methods used to circumvent it. Attackers no longer just try to steal your password; they try to exhaust your patience or trick your browser into handing over the keys to the kingdom.
What an MFA fatigue attack actually means
In a standard MFA fatigue attack, the criminal has already obtained a user's valid username and password, often through a previous phishing campaign or a data breach leak. They enter these credentials into the login page. When Microsoft 365 or Google Workspace sends a push notification to the user's phone, the attacker simply triggers it repeatedly.
The goal is psychological. By bombarding a target with notifications at antisocial hours or during a busy workday, the attacker relies on human error. The user might assume their app is glitching, or they might simply be tired of the interruption. One accidental tap of the 'Approve' button is all the attacker needs to gain full access to the mailbox, SharePoint files, and company data.
This is often combined with a technique called Adversary-in-the-Middle (AitM) phishing. In this scenario, the attacker sets up a proxy server that sits between the user and the real login page. When the user logs in to the fake page, the attacker captures not just the password, but the session token itself. A session token is a digital 'pass' that tells the server the user has already successfully authenticated. If an attacker steals this token, they do not even need the MFA code; they can simply 'become' the user in their own browser.
The commercial impact of a bypassed login
For a UK SME, the successful bypass of MFA is rarely a quiet event. It is usually the precursor to business email compromise (BEC) or a ransomware deployment. Once inside, an attacker can set up silent forwarding rules on a director's mailbox, monitor conversations for pending invoices, and then interject with a 'change of bank details' request.
Beyond the direct financial loss of a diverted payment, the regulatory and operational costs are significant. Under UK GDPR, a compromised account containing personal data must be assessed for risk. If the risk to individuals is high, you must notify the Information Commissioner's Office (ICO) within 72 hours. This often requires bringing in external forensic investigators to determine exactly what data was accessed, which is a costly and disruptive process.
Cyber security services are no longer about just having a firewall. They are about ensuring that the identity at the centre of your business, the user account, is actually who it says it is, even when the person behind the screen is tired or distracted.
How to move toward phishing-resistant MFA
Defending against these attacks requires moving away from 'simple' push notifications. A pattern we see on most tenants we take on is that 'Notify through app' is still the default MFA method, which is the exact door these attacks walk through. To close it, we recommend a tiered approach to hardening your authentication.
1. Enable Number Matching
Microsoft has now made number matching a default for Microsoft Authenticator, but many organisations have not yet fully enforced it or are still allowing weaker methods like SMS. With number matching, when a user tries to log in, the screen displays a two-digit number. The user must then type that specific number into the app on their phone to approve the request. This completely neutralises push bombing because an attacker cannot guess the number, and a user cannot accidentally 'approve' a request by just tapping a button.
2. Implement Location and App Context
You can configure your identity provider to show the user where the login request is coming from. If an employee in Birmingham sees an MFA prompt originating from an IP address in a different country, they are far more likely to hit 'Deny'. While attackers can use VPNs to mask their location, adding this context provides an extra layer of friction that stops many automated attacks.
3. Use Conditional Access Policies
Conditional Access is a set of 'if/then' rules. For example: If a user is logging in from a device that we do not manage (BYOD) and they are outside the UK, then block access entirely. By restricting logins to known, healthy devices and specific geographies, you reduce the 'attack surface' available to the criminal. This is a core component of Microsoft 365 security.
4. Transition to FIDO2 and Passkeys
The gold standard is phishing-resistant MFA. This involves using hardware security keys (like a YubiKey) or device-based passkeys (using Windows Hello or Apple FaceID). These methods use the FIDO2 standard, which creates a cryptographic link between the device and the specific website. Because the key will only sign a challenge from the genuine website, an AitM proxy site cannot trick the user into giving up their session. The login simply fails on the fake site.
The cost of a fatigue attack: A worked scenario
To understand the value of these protections, consider a hypothetical 20-person UK professional services firm. A senior partner is push-bombed at 11:00 PM on a Sunday and eventually hits 'Approve'.
- Sunday 11:15 PM: Attacker gains access, creates a 'hidden' folder in Outlook, and sets up rules to move all incoming mail from the finance department there.
- Monday 9:00 AM - Tuesday 5:00 PM: Attacker monitors mail, learns the tone of voice, and identifies a £15,000 invoice due for payment.
- Wednesday 10:00 AM: Attacker sends a spoofed email from the partner's account to the client with 'updated' banking details.
- The Damage: The £15,000 is lost. Forensic IT support to clear the tenant and find the 'backdoors' costs roughly £3,000. Staff downtime while accounts are frozen and passwords reset across all systems totals 16 hours. At an average cost of £50 per hour per staff member, that is another £16,000 in lost productivity.
The total cost of one accidental tap is £34,000. In contrast, implementing Cyber Essentials controls and enforcing number matching costs a fraction of that figure.
Common mistakes in MFA deployment
We frequently encounter the same three errors when auditing new client environments:
- Allowing SMS as a primary or backup method. SMS is not secure. It can be intercepted via SIM swapping or 'interworking' attacks. It should be disabled in favour of app-based or hardware-based MFA.
- Excluding 'service accounts' from MFA. Often, businesses leave accounts used for printers or legacy software without MFA. Attackers look for these 'forgotten' accounts as an easy way to get a foothold in the network.
- Ignoring 'Impossible Travel' alerts. Most modern systems will flag if a user logs in from London and then ten minutes later from Singapore. If these alerts are not being monitored by a 24/7 SOC, the attack will succeed long before anyone notices.
The regulatory perspective
The ICO and the National Cyber Security Centre (NCSC) are increasingly clear: basic MFA is the minimum, but it is no longer enough on its own. If a business suffers a breach because they were using 'guessable' or 'push-only' MFA, they may find it harder to defend their technical and organisational measures during a GDPR audit. Furthermore, most cyber insurance providers now explicitly ask if you use 'phishing-resistant' or 'number-matching' MFA for all remote access. Answering 'no' can lead to higher premiums or a total refusal of cover.
How Black Sheep Support helps
We move UK SMEs away from vulnerable, 'noisy' security and toward silent, robust protection. We don't just 'turn on' MFA; we configure it so it doesn't get in the way of your staff while remaining impenetrable to attackers.
If you are worried that your current MFA setup is leaving a door open
and we'll help you map out a path to phishing-resistant security.
We also handle hardware, broadband, mobile and networking, ensuring your entire infrastructure is as secure as your login process.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture: 30 to 60 minutes with one of our engineers on a Teams call, or 15 to 20 minutes on your own, no commitment.
MFA Security FAQ
Is Microsoft Authenticator number matching mandatory? Yes, Microsoft has made it the default for all users of the Authenticator app. However, if your users are still using older versions of the app or using SMS/Voice calls, they are not protected by number matching. You must actively disable these weaker methods to ensure full protection.
What should an employee do if they receive an unexpected MFA prompt? They should immediately tap 'Deny' (or 'No, it's not me') and report it to your IT helpdesk. An unexpected prompt means their password has already been compromised. The helpdesk needs to reset their password and revoke all active sessions immediately to kick the attacker out.
Do hardware keys like YubiKeys work for small businesses? Absolutely. While they require a small upfront hardware cost, they are the only truly phishing-resistant form of MFA. They are particularly useful for high-risk users, such as those in finance or those with global admin rights, where the cost of a breach is highest.
Does MFA number matching stop all phishing? No. While it stops push bombing, it does not stop 'token theft' via Adversary-in-the-Middle attacks. To stop those, you need to implement Conditional Access policies that require 'Compliant Devices' or move to FIDO2 passkeys which bind the login to the hardware.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
