MFA fatigue: what is it and how to protect yourself?

Your phone buzzes. Another login notification. You glance at it: “Approve sign-in attempt?” You hit deny because you’re not trying to log into anything. Two minutes later, buzz. Same notification. Deny again.

Then it happens again. And again. And again.

By the 15th notification in 10 minutes, you’re ready to throw your phone across the room. So when the next one pops up, you just hit “approve” to make it stop.

That’s exactly what the cybercriminal on the other end was hoping for.

This frustrating but effective attack is called MFA fatigue, and it’s becoming one of the most successful ways hackers break into accounts. Even the most security-conscious among us can fall victim to this digital harassment.

Understanding what’s happening and how you can protect yourself is essential.

What is multi-factor authentication (MFA)?

Multi-factor authentication (MFA) – often called two-factor authentication – is basically a fancy way of saying “double-check that it’s really you.” Instead of just typing in your password, you also need to prove your identity in another way, usually by approving a notification on your phone or entering a code from an app.

Types of two-factor authentication methods

The most common MFA methods include:

• Push notifications: those “approve/deny” pop ups on your phone;
• SMS codes: text messages with 6-digit numbers;
• Authenticator apps: like Google Authenticator that generate time-based codes;
• Hardware keys: physical devices you plug in or tap; and
• Biometrics: fingerprints, face scans, and voice recognition.

Benefits of dual authentication systems

MFA blocks about 99.9 per cent of automated attacks, making it one of the most effective security measures available. Even if someone steals your password, they still can’t get into one of your accounts without that second verification step.

How secondary authentication enhances security

MFA works by requiring something you know (password) plus something you have (phone) or something you are (fingerprint) to be entered into an app’s system to log in. This multi-layered approach means attackers need to compromise multiple layers or information to access your account, and it serves as an early warning sign for you if someone has your password.

What is an MFA fatigue attack?

An MFA fatigue attack is basically digital harassment with a purpose. Criminals look to flood your phone with legitimate-looking login requests until you get so annoyed that you approve one just to make the notifications stop.

The role of social engineering in MFA bombing

What makes these attacks even worse is the human element. Attackers may also call you while the notifications are flooding in, pretending to be IT support: “Hi, there are system issues. You might get some login prompts. Just approve one to fix the problem.”

Why MFA fatigue attacks succeed

Human behaviour factors in dual authentication

Everyone is drowning in digital notifications. The average smartphone user gets 60 to 80 per day. When your phone buzzes with an MFA request, it’s competing with texts and social media and news alerts. Decision fatigue also plays a part in this problem, especially when attacks happen late at night or early morning.

Common user response patterns

There are a number of reasons people approve these kinds of requests, even if they know better.

• The “make it stop” response: People often approve these requests just to end the annoyance of seeing multiple alerts pop up on their phone.
• Assumption of legitimacy: Because these alerts appear to come from a legitimate source, a person may click “approve” because they think something must be real.
• Muscle memory approval: With all the alerts that pop up on our phones, automatic approval without thinking is commonplace.

The psychology behind attack effectiveness

These attacks exploit cognitive biases like authority bias (trusting official-looking requests) and time pressure (feeling rushed to “resolve” a situation quickly).

How to protect yourself against MFA fatigue?

Set up proper authentication controls

Never approve what you didn’t initiate. If you get an MFA request and didn’t just try to log into an app, always deny it.

Enable number matching when possible. Microsoft began enforcing this globally in May 2023 specifically to combat MFA fatigue attacks.

Use app-based authentication over SMS for better security and more context about login attempts.

Implement secure login protocols

Beyond just knowing how to spot attacks, there are basic security hygiene measures that’ll make your accounts harder to crack:

• Use unique passwords everywhere and store them in a password manager;
• Enable account lockouts, so your accounts shut down after multiple failed sign-in attempts;
• Set up security alerts for unusual account and app login activity; and
• Keep your app and account recovery options up to date.

Steps to report suspicious activity

If you experience an MFA attack:

• Document everything with screenshots and timestamps;
• Report it to the service provider immediately;
• Contact the Canadian Anti-Fraud Centre (1-888-495-8501); and
• Notify your financial institutions if bank accounts are involved.

Reminder: If you receive suspicious communications claiming to be from Sun Life, or if you think your account has been compromised, contact us immediately. Our security team is available to help secure your account and investigate any unauthorized activity.

This article is meant to provide general information only. Sun Life Assurance Company of Canada does not provide legal, accounting, taxation, or other professional advice. Please seek advice from a qualified professional, including a thorough examination of your specific legal, accounting and tax situation.