It is 11:40 at night and your phone buzzes with a sign-in approval. You did not sign in. It buzzes again. And again. Somewhere, someone has your password and is betting that you will tap Approve just to make the noise stop.
This is called MFA fatigue, or push bombing, and it works on real people. This tip covers what to do when it happens and which settings take the bet away from the attacker.
How the trick works
Multi-factor authentication only helps if the person approving is the person signing in. If an attacker already has your password, the only thing left in the way is you. So they trigger prompt after prompt, sometimes hoping for a mistaken tap, sometimes hoping for an annoyed one.
The rule
If you did not just try to sign in, deny the prompt. Do not tap Approve to make it stop, and do not wait it out. Then tell IT and change that password from a device you trust, because a prompt you did not trigger means someone has the password.
Turn on number matching
Number matching removes the blind tap. According to Microsoft, when a user answers an Authenticator push notification, they see a number and must enter that number into the app to complete the approval. Microsoft documents that number matching is enabled for all Authenticator push notifications.
An attacker cannot see the number on your sign-in screen, so a spam prompt that shows up out of nowhere has nothing to match. If your team uses another authenticator, check its settings for the same feature.
What admins should watch for
Repeated failed or denied approvals for one user in a short window are a sign someone is working on that account. Set an alert for it, and follow up with the person the same day. It is cheap to check and expensive to ignore.
The bigger lesson
Security prompts fail when they train people to click through them. The goal is a sign-in flow where the right choice is obvious at 11:40 at night. Setting that up, and watching for the warning signs, is part of how we run managed IT services for clients.
Sign-in prompts should be easy to get right at 11:40 at night. We set up number matching, alerts, and passkeys so a tired tap does not hand over an account. No pressure, no obligation, just a straight look at your setup.
Book a 10-Minute Discovery Call →Frequently asked questions
What is MFA fatigue?
It is an attack where someone who already has your password repeatedly triggers approval prompts, hoping you approve one by mistake or just to stop the alerts.
What should I do if I get a prompt I did not start?
Deny it, tell IT, and change the password for that account from a trusted device. A surprise prompt means your password is likely known to someone else.
What is number matching?
It is a feature where you must type a number shown on the sign-in screen into your authenticator app before the approval goes through. It blocks blind approvals of prompts you did not start.
Are text message codes safer than push approvals?
Not necessarily. Any method can be abused if a person is tricked into handing over or approving something. Passkeys and hardware keys are the stronger option because there is nothing to approve blindly or read out to a caller.
Can safemode IT configure this for our Microsoft 365 accounts?
Yes. We check your sign-in settings, turn on the protections, and set alerts for suspicious activity. See our managed IT services or ask for a free assessment.
Source: Microsoft Learn, Number matching in MFA notifications
Last updated: October 22, 2026
