MFA push abuse is a tactic that bombards a user with repeated multi-factor authentication approval prompts until they become frustrated, distracted, or convinced the prompts are legitimate. It is often called push bombing or MFA fatigue. The attacker usually starts with stolen credentials or a phishing session, then uses the push requests to pressure the target into approving one of them.
This matters because many identity systems treat a push approval as proof that the right user is present. If the user is tricked into tapping Approve, the attacker may obtain a valid session without ever breaking the password. Defenders reduce this risk with phishing-resistant MFA such as FIDO2 or passkeys, number matching, device trust checks, rate limiting, and alerts for repeated prompts or suspicious enrollment changes. In real attacks, MFA push abuse is often paired with lookalike login pages, vishing, or help desk impersonation to make the approval seem expected.