MFA prompt abuse is the act of tricking a user into approving a multifactor authentication request they did not initiate. Attackers often combine impersonation, urgency, and repeated push notifications to make the victim accept a login prompt, turning a human decision into unauthorized access.
This matters because many MFA systems rely on user approval. If the attacker already has a password, a stolen session token, or a fake support story, one approved prompt can complete the sign-in. Defenders reduce this risk by using phishing-resistant MFA such as FIDO2 security keys or passkeys, adding number-matching or device binding, and alerting users to unexpected prompts. Monitoring for impossible travel, unusual device enrollments, and rapid prompt bursts can also help detect abuse early.