Why Your Phone Keeps Buzzing ‘Approve?’ And How to Shut Attackers Out
It’s 2 a.m. Your phone lights up: “Approve this sign-in?” You didn’t try to log in, so you tap Deny and roll over. A minute later it buzzes again. Then again. By the twentieth notification you’re groggy, annoyed, and one bad thumb-tap away from handing a stranger the keys to your account.
That’s not a bug. It’s a deliberate attack, and it has a name: push bombing, sometimes called MFA fatigue. Understanding it takes five minutes, and defending against it takes about the same.
How the attack works
Most of us protect important accounts with a second step beyond the password — a code, or a push notification that asks us to approve a login. That second step is called multi-factor authentication (MFA), and it’s genuinely good protection. But the “just tap Approve” style of MFA has a soft spot: it depends on a tired human making the right call.
Here’s the sequence. An attacker already has your password (bought from a leak, guessed, or phished). The password alone won’t get them in — they still need you to approve the login. So they simply try to log in over and over, firing off a push notification each time. The goal is to wear you down until you approve out of confusion, reflex, or sheer desire to make the buzzing stop.
Sometimes they pair it with a phone call: “Hi, this is IT — we’re testing the login system, please approve the prompt.” Now the flood has a friendly explanation, and approving feels helpful instead of risky.
A worked example: how “number matching” changes the odds
Imagine an attacker sends 50 approval prompts to a sleepy employee named Rafael overnight. Suppose that each time a plain “Approve / Deny” prompt appears, there’s roughly a 3% chance he taps Approve by mistake.
The chance he never slips on a single prompt is 0.97 raised to the 50th power — about 0.22, or 22%. Flip that around: there’s a 78% chance he approves at least one. Over enough prompts, a plain tap-to-approve system almost guarantees a mistake.
Now switch on number matching. Instead of a yes/no tap, the login screen shows a two-digit number that Rafael must read and type into his phone. He can’t approve a login he didn’t start, because he never sees the number the attacker is looking at. Accidental approval drops from “3% per prompt” to effectively zero, because there’s nothing to accidentally tap — he’d have to correctly guess a number he was never shown. Fifty prompts, 500 prompts, it doesn’t matter: the flood becomes noise he can ignore.
That single setting turns a 78% chance of disaster into a rounding error.
In practice: what actually stops push bombing
- Turn on number matching (also called “number challenge”) in your authenticator app or identity provider. It’s the highest-value quick fix and is built into most major platforms today.
- Treat unexpected prompts as an alarm, not an annoyance. A prompt you didn’t trigger means someone already has your password. Deny it, then change that password right away.
- Move to phishing-resistant logins where you can. Passkeys and hardware security keys use cryptography tied to the real website’s address, so there’s no code to type and nothing to approve by mistake. National guidance and the FIDO standards bodies point to these as the strongest option available.
- Never approve a login because someone on the phone asked you to. Real IT departments don’t need you to approve a prompt to “test” anything.
Common mistakes
- Blaming the user. If people keep approving bad prompts, the fix is a better system (number matching, passkeys), not a sterner memo.
- Assuming any MFA is equal. Tap-to-approve and SMS codes are far better than nothing, but both can be defeated by a determined attacker. Phishing-resistant methods are a real step up.
- Ignoring the first stray prompt. That single unexpected buzz is the early-warning signal that your password has leaked. Act on it.
Quick check
- What is the attacker’s goal when they send you a flood of approval prompts?
To wear you down until you approve one by mistake or annoyance — they usually already have your password. - How does number matching stop accidental approvals?
It forces you to read a number from the login screen and type it into your phone. If you didn’t start the login, you never see the number, so you can’t approve it. - You get a login prompt you didn’t request. What should you do?
Deny it and change that account’s password immediately — the prompt means someone already has your password.
Sources & References
- NIST SP 800-63B, Digital Identity Guidelines — Authenticators
- NIST SP 800-63B, Digital Identity Guidelines (full document)
- CISA — Implementing Number Matching in MFA Applications
- Microsoft Entra — How number matching works in Microsoft Authenticator
- FIDO Alliance — Passkeys
Image credit: https://stocksnap.io/photo/keys-padlocks-D5D3B74933 — cc0 1.0 (via Openverse)
This article is for general educational purposes only and does not constitute professional, legal, or security advice.
