MFA fatigue is an attack in which someone who already has a victim's password sends repeated multi-factor authentication (MFA) approval requests to their phone until the person accepts one out of frustration or confusion. It is also called MFA bombing or push bombing. It is mitigated with number matching, attempt limits and phishing-resistant methods such as passkeys.
Related term in this glossary: MFA (multi-factor authentication)
MFA bombing, push bombing, MFA prompt bombing, push notification spam, MFA fatigue attack