In this guide · 8 sections
Short answer
An unexpected MFA prompt means someone has the password and is trying to sign in. Deny it, never approve, report it, and change the password straight away. Then turn on number matching (on by default in Microsoft Authenticator) and move admins and key staff to passkeys, which cannot be approved by mistake.
What an unexpected MFA prompt means
Multi-factor authentication (MFA) asks for a second proof after the password. A push prompt on your phone only appears after someone has typed the correct password. So an unexpected prompt is not a glitch. It is a sign that your password has leaked, through phishing, a reused password from another site, or malware.
In an MFA fatigue attack, also called push bombing or prompt bombing, the attacker keeps triggering prompts, sometimes dozens in a row or at 2am, hoping the person gets annoyed or confused and approves one. Some attackers also message or call pretending to be IT support, saying the prompts are part of a system check and asking the person to approve.
What to do in the next 10 minutes
Print this for staff. It works for Microsoft 365, Google Workspace and most other services.
Deny the prompt, do not approve
In Microsoft Authenticator, choose No, it's not me. If there is an option to report it, use it. Do not approve to stop the noise.
Tell your manager or IT straight away
A quick message is enough: which account, what time, how many prompts. Do not wait until the next day.
Change the password from a trusted device
Use a new, unique password that is not used anywhere else. A password manager makes this easy.
Sign out all other sessions
In Microsoft 365, an admin can revoke sessions for the user. In Google, use the security page to sign out of other devices.
Check the sign-in history
Look for successful sign-ins from unfamiliar locations or devices around the time of the prompts.
Check for mailbox rules and forwarding
If anyone got in, they often add hidden forwarding or delete rules. Follow the hacked email steps if you find any.
If someone did approve a prompt, treat it as a compromised account. Our business email hacked guide covers the clean-up.
Number matching: why Approve and Deny are not enough
Older push prompts showed only Approve or Deny, which is what made fatigue attacks work. Microsoft's number matching documentation states that number matching is now enabled for all Microsoft Authenticator push notifications. The sign-in screen shows a number, and the user must type that number into the app to approve.
This helps because the attacker sees the number on their own screen, not the user. A person who is not signing in has no number to type. It does not make push MFA perfect: an attacker who phones the user can still ask them to read out or type a number. That is why training and phishing-resistant methods still matter.
| MFA method | Fatigue risk | Phishing resistance |
|---|---|---|
| SMS code | Low (no push), but SIM swap risk | Weak |
| Push with Approve / Deny only | High | Weak |
| Push with number matching | Low | Moderate |
| Authenticator app code (TOTP) | None | Moderate |
| Passkey or security key (FIDO2) | None | Strong |
Move key accounts to passkeys
Microsoft describes passkeys as FIDO2-based credentials that provide strong, phishing-resistant authentication (Microsoft Entra passkey guide). A passkey is tied to the real website and unlocked with a fingerprint, face or PIN on your device. There is no prompt for an attacker to trigger and nothing for a user to approve by mistake.
You do not need to switch everyone at once. Start with the accounts that would hurt most:
- global administrators and anyone with admin rights in Microsoft 365 or Google Workspace;
- finance staff with access to banking, payroll and accounting;
- directors and anyone whose email is used to approve payments;
- staff who have already been targeted by prompts or phishing.
Google Workspace supports passkeys and security keys too. Our MFA set-up guide walks through enabling MFA on both platforms.
Microsoft 365 and Google settings that help
A few settings reduce the risk without buying anything new. In Microsoft 365, security defaults require all users to register for MFA, require MFA for administrators, and block legacy authentication protocols that skip MFA altogether, according to Microsoft's security defaults page. Microsoft also removed the 14-day grace period for registering MFA from July 2024.
MFA fatigue protection checklist
Unique passwords cut off the source of the problem. If staff reuse passwords, one breach elsewhere can trigger prompts on your work accounts. Our password manager guide compares the options.
Teaching staff what a prompt means
The technology only works if people react the right way. The message to staff should be short and repeated:
- a prompt you did not start means someone has your password;
- IT will never ask you to approve a prompt over the phone or chat;
- deny, report, change your password, in that order;
- nobody gets in trouble for reporting, even if they approved by mistake.
The last point matters most. Staff who fear blame stay quiet, and an account taken over at 2am is found days later through a fake invoice sent to a customer.
Do it yourself or get help?
If you run Microsoft 365 or Google Workspace yourself, turning on security defaults, checking number matching and registering passkeys for admins takes an afternoon. The tricky part is legacy apps and shared accounts that break when MFA is enforced.
Our Microsoft 365 / Google Security Lockdown (S$590) enforces MFA for up to 15 users, blocks legacy sign-ins and risky apps, cleans up admin roles and sets up a break-glass account. To make 'deny and report' second nature, Security Awareness Training (S$390) delivers short monthly lessons with completion tracking.
Frequently asked questions
Authenticator only sends a sign-in request after the correct password has been entered. If you are not signing in, someone else has your password and is trying to get past MFA. Deny the request, report it to whoever manages your IT, change your password straight away and check your recent sign-in activity.
Yes. Denying the prompts stopped this attempt, but the attacker still has a working password and can try again later or use it against other services if you reused it. Change it to a new unique password, sign out other sessions, and check that MFA methods on the account are ones you registered.
Number matching shows a number on the sign-in screen that the user must type into the authenticator app to approve. Because only the person actually signing in can see the number, someone receiving an unexpected prompt cannot approve it by reflex. Microsoft has enabled number matching for all Microsoft Authenticator push notifications.
For resisting phishing and fatigue attacks, yes. Passkeys are FIDO2 credentials tied to the real website and unlocked on the user's device with a fingerprint, face or PIN. There is no prompt to bomb and no code to read out to a scammer. Many businesses start with passkeys for admins and finance staff.
SMS avoids push bombing, but it has its own weaknesses: codes can be phished on fake login pages and phone numbers can be hijacked through SIM swaps. It is better than no MFA, but an authenticator app with number matching, or a passkey, is stronger for business accounts.