Treat MFA Fatigue as an Attack Signal
Respond correctly when repeated MFA prompts arrive without a matching login attempt.
You receive repeated MFA push prompts, but you are not trying to sign in anywhere. MFA DECISION What should you do first? Deny the prompts, stop logging in elsewhere, and report a possible account-takeover attempt. Strong. This treats the prompt as evidence that a password may already be exposed and prevents fatigue from turning into approval. Approve one prompt so the system stops asking, then change the password later if it happens again. Weak. This violates the principle behind MFA by granting access to a sign-in you did not initiate. Ignore the prompts because strong passwords make accidental MFA prompts…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in