TryBench
MFA Fatigue Attack: How to Stop Push Bombing
Recognize push bombing, advise users to deny prompts, alert IT to revoke sessions, and implement number matching.
Why this matters
Attackers who know your password may spam your phone with login approvals until you tap Approve. Knowing the right response stops the attack.
Attackers Spam Login Prompts
With a stolen password, attackers send many login prompts to your phone at night. They hope you will tap Approve just to stop the noise.
In real life: Imagine someone ringing your doorbell all night. By 3 AM you open the door just to get some peace. That is exactly what the attacker is counting on.
A Surprise Prompt Is a Warning
A login prompt you did not start usually means someone has your password. Deny it and tell IT.
In real life: If a stranger arrives with your front-door key at midnight, you know someone copied it. A login prompt you did not start tells you the same thing about your password.
Modern Controls: Number Matching
Number matching makes you type a number from the login screen, so blind taps fail. Security keys and passkeys are stronger still.
In real life: Number matching is like a bank that reads you a number over the phone and asks you to repeat it. A blind approval cannot pass that test, because the attacker cannot see the number.
Your practice task
Have the AI write a short security containment directive (30 words or fewer, no greeting) for user chidi.okafor@lagos-fintech.ng. Instruct them to deny the push prompt, and confirm IT will revoke active sessions and reset their password.
How to do it
- Read the alert above. Note the many prompts at night.
- Ask the AI to write a short order of 30 words or fewer, with no greeting.
- Name the user and tell them to deny the prompt.
- Say IT will revoke sessions and reset the password. Press Run proof.
Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.
Quick reference: MFA Fatigue Containment Protocol
Immediate response protocol when users report midnight push storms.
Instruct user to deny unrequested push notifications immediately. Revoke all active session tokens, force password reset, and enable MFA number matching or passkeys.
More lessons in this course
- Enforcing Least PrivilegeAudit staff permissions in a markdown table and downgrade excessive admin rights.
- Spotting Unauthorized Bulk ExportsRead multi-line server logs to isolate off-hours mass customer data downloads and data exfiltration.
- Fake Invoice Scam: Spot Business Email CompromiseSpot typosquatted vendor domains, enforce out-of-band phone verification, and layer email security controls.