What is multi-factor authentication fatigue?¶

Multi-factor authentication fatigue is a social-engineering technique in which repeated authentication prompts are used to pressure or confuse a user into approving one.

Avoid the dangerous assumption¶

The dangerous assumption is that an approved prompt proves the user knowingly authorised the login.

It may not.

An offender may already know the password and repeatedly trigger prompts until the user:

• approves by mistake
• assumes the request is legitimate
• responds to stop the interruptions
• is persuaded by a follow-up call or message.

Evidence may include:

• multiple denied or ignored prompts
• one later approval
• authentication attempts from unfamiliar infrastructure
• telephone or messaging contact
• subsequent account activity
• changes to security settings or sessions.

Investigators should establish the sequence.

How many prompts occurred?

Over what period?

Which device received them?

Was the user contacted?

What explanation did they believe?

What happened immediately after approval?

Do not assume every repeated prompt is malicious. Misconfigured applications, old sessions or legitimate repeated login attempts may also generate prompts.

Likewise, an approved prompt does not prove the user was careless or complicit. The context and representation matter.

Ask the provider for authentication method, challenge result, device information, source infrastructure, session details and later actions.

The offender may retain access after the initial approval through a session or token, so containment should not focus only on changing the password.

Record whether the prompt displayed location, application or number-matching information and what the user recalls seeing. Those details may explain why the request was approved or why it appeared legitimate.

Operational takeaway¶

Reconstruct the full sequence of prompts, user contact, approval and later account activity before treating an approved challenge as informed authorisation.