iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use phishing-resistant MFA—a FIDO2/WebAuthn security key or passkey—on every important account that supports it. Where a service offers only authenticator push, turn on number matching and approve requests only when you started the sign-in. Deny every unexpected prompt, then investigate the account through its official app or website. Number matching reduces push bombing but does not make sign-in phishing-resistant.
What MFA fatigue attacks are
Multi-factor authentication (MFA) fatigue, also called push bombing, is an attack that abuses repeated approval notifications. An attacker first obtains or guesses a password, starts sign-in attempts against the account, and relies on a stream of mobile-app prompts to wear down the account owner. The victim may approve accidentally, tap Approve simply to stop the alerts, or accept a request while distracted.
CISA describes the attack as an actor bombarding a user with mobile-application push notifications until the request is approved “by accident or out of annoyance with the nonstop notifications.” A prompt that you did not initiate is therefore a security warning, not a harmless technical glitch. Denying it is the correct response.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Signs that an attack may be under way
- Several MFA prompts arrive close together when you are not signing in.
- A notification names a service or device you do not recognize.
- A caller, text message, chat, or email asks you to approve a prompt or read out a code.
- You receive a password-reset or sign-in alert immediately before unexpected MFA requests.
- Prompts continue after you have denied them.
Attackers may combine prompts with a convincing phone call or a fake support message. Treat the request and the surrounding communication as untrusted until you verify the account through an official channel that you opened yourself.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the strongest MFA method your account supports
MFA methods do not provide equal protection. CISA’s comparison places phishing-resistant FIDO/WebAuthn and PKI methods above app-based one-time passwords and number-matching push. Ordinary push approval, SMS, and voice codes have important weaknesses.
| Method | Protection against push fatigue | Phishing resistance | How to use it |
|---|---|---|---|
| FIDO/WebAuthn security key or passkey | Push bombing does not apply to this phishing-resistant flow. | Phishing-resistant. | Prefer it wherever the account, device, and recovery process support it. |
| Authenticator push with number matching | CISA’s comparison describes it as resistant to push bombing. | Still vulnerable to phishing. | Use as an interim improvement over a blind Approve/Deny prompt. |
| Authenticator-app one-time password (OTP) | There is no unsolicited push to approve, but a user can be tricked into revealing the code. | Vulnerable to phishing. | Use when stronger methods are unavailable; enter codes only in the official site or app you opened. |
| Push notification without number matching | Vulnerable to push bombing and user error. | Not phishing-resistant. | Avoid it when the provider offers number matching or a stronger method. |
| SMS or voice code | It does not use an approval push. | Not phishing-resistant; CISA also identifies exposure to phishing, SS7, and SIM-swap attacks. | Reserve it for situations in which stronger choices are unavailable. |
Compare an account’s real options by phishing resistance, resistance to push bombing, supported devices, recovery requirements, and deployment effort. A method’s availability depends on the provider and your device; the security ranking does not guarantee that every account offers every choice.
FIDO2, WebAuthn, security keys, and passkeys
A security key is a physical authenticator that you tap or insert during sign-in. A passkey uses the same FIDO/WebAuthn family of standards through a compatible device or password manager. The site is cryptographically bound to the legitimate domain, so a fake login page cannot simply collect a reusable code. CISA identifies these methods as the strongest widely available option in its guidance.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBefore registering one, check the account’s supported protocol, USB or wireless connector, operating-system support, and recovery procedure. Register a second key or another approved recovery method if the service permits it, and store the spare securely. A stronger sign-in method is useful only if you can still regain access when a device is lost.
Number matching
With number matching, the sign-in screen displays a number and the authenticator app asks you to enter that number before approval. This makes blind tapping harder and mitigates push bombing. It is an interim control, not a phishing-resistant one: a real-time phishing site can relay the sign-in and persuade you to enter the displayed number.
Authenticator codes
An OTP app avoids approving an unsolicited push, but it does not prevent a phishing site from asking for the current code. Never disclose an OTP to a caller, support chat, text message, or email. Open the service yourself, check the address, and enter the code only there.
Secure your highest-value accounts first
Start with accounts that can reset other accounts or expose sensitive information. CISA specifically identifies email, financial services, social media, online stores, gaming, and streaming services as places to implement MFA. For organizations, administrators, remote-access accounts, and people who handle sensitive data should be first in line.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
1. Map the accounts that matter most
- Primary and recovery email accounts.
- Banking, payment, tax, and other financial services.
- Cloud storage, password managers, and work administration portals.
- Social, shopping, gaming, and streaming accounts that contain payment data or personal information.
- Mobile-carrier and device accounts that could be used for a SIM swap or password reset.
Protect the email and identity accounts first because control of them can enable resets elsewhere.
2. Prepare recovery before changing sign-in requirements
Review the account’s recovery email address, phone number, backup codes, trusted devices, and registered authenticators. Remove methods that are not yours. Store backup codes in a secure location that is separate from the device used for everyday sign-in. If you are an administrator, register the required phishing-resistant method and test emergency access before enforcing a policy; Microsoft warns that enforcing first can lock administrators out.
3. Enable MFA in the official security settings
- Open the provider’s official app or type its known address yourself; do not use a link in an unexpected message.
- Go to the account’s Security, Sign-in, or Authentication section.
- Choose a passkey or FIDO/WebAuthn security key if it is offered.
- Register the device, complete a test sign-in, and add an approved backup method.
- If only an authenticator app is available, select number matching rather than a simple approval prompt.
- If the service offers only OTP, protect the authenticator device and keep every code private.
Provider labels and enrollment flows change. Use the current instructions shown for your account rather than assuming another service has the same controls.
4. Review sessions and recovery after enrollment
Check recent sign-ins, active sessions, connected devices, recovery methods, and third-party applications. Sign out devices you do not recognize and remove unfamiliar applications. This review matters because MFA enrollment does not erase an attacker’s existing session or a compromised recovery method.
What to do when an unexpected MFA prompt appears
Handle the first prompt safely
- Deny the request. Do not tap Approve merely to stop the notification.
- Do not enter a number, read a code aloud, or share a screenshot.
- Do not call a number supplied in the notification or message.
- Open the account through its official app or a manually entered address and check recent sign-ins.
If prompts keep arriving
Change the password from the legitimate service, provided you can do so safely. Use a new password that is not reused elsewhere. Review recent sign-ins, recovery email and phone details, registered MFA methods, active sessions, and connected applications. Remove devices or sessions you do not recognize, then contact the provider through its official support channel. Exact menu names differ by provider, so follow the account’s current security workflow.
If you approved a prompt by mistake
Assume the attacker may have gained access. Immediately change the password through the real service, revoke unfamiliar sessions, verify recovery methods, replace compromised MFA registrations, and check for mailbox forwarding rules or other persistence mechanisms where the provider exposes them. Notify your organization’s security team or the relevant financial institution through a known contact route if the account is used for work or money.
Provider-specific details
Microsoft Entra and Microsoft Authenticator
Microsoft documents number matching for Authenticator push notifications in supported Microsoft Entra scenarios. It is not supported for push notifications sent to an Apple Watch or Android wearable. Microsoft also documents a same-device experience in some Microsoft mobile apps in which the user can reply Yes or No under specified conditions; browser sign-ins continue to require entering the displayed number.
Rank #3
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Administrators applying a Conditional Access policy that requires phishing-resistant MFA for administrator roles should first confirm that every administrator has registered an appropriate method. Test emergency-access and recovery procedures before enforcement. Microsoft warns that applying the requirement before registration can lock tenant administrators out. Recheck Microsoft’s current platform documentation before deployment because supported scenarios and defaults can change.
Google Accounts
Google documents passkeys and hardware security keys as phishing-protective choices. Google prompts are an alternative second step for users who are not signing in with a passkey. Open your own Google Account security settings to see which choices, devices, and recovery methods are available; there is no single setting that applies identically to every account.
Other providers
Do not assume that a push notification, number-matching screen, passkey, or recovery process works the same way across services. Read the provider’s current security documentation, confirm which devices are supported, and perform a controlled test sign-in after enrollment.
Guidance for organizations and administrators
Roll out protection by risk
- Require MFA for administrators and privileged accounts.
- Protect remote access and accounts handling sensitive data.
- Extend coverage to the rest of the workforce and important external services.
- Prefer phishing-resistant methods for high-value accounts.
- Use number matching as an interim mitigation where a provider cannot yet deploy phishing-resistant MFA.
Document who receives security alerts and how employees report repeated prompts. Make the rule explicit: deny any request that was not initiated by the employee, then report it. A clear escalation channel prevents users from accepting a prompt simply because they cannot find help.
Stage enforcement without creating lockouts
- Inventory current MFA methods and identify administrators who lack the required method.
- Enroll and test phishing-resistant methods before enabling a policy that requires them.
- Maintain emergency-access accounts with protected credentials and a tested recovery procedure.
- Communicate the enrollment deadline, the exact official sign-in path, and the response to an unexpected prompt.
- Monitor sign-in and MFA-denial events for repeated attempts against one user or many users.
Number matching lowers the chance of an accidental approval but does not remove the need for phishing training, secure recovery, and sign-in monitoring.
Protect the recovery path
Attackers often target recovery because it can bypass a carefully configured primary factor. Keep recovery email and phone details current, secure the mailbox and carrier account with strong MFA, and store backup codes where an attacker who compromises your everyday device cannot immediately find them. Remove old phone numbers, lost security keys, and former employees’ authenticators.
When a provider supports multiple authenticators, register a spare key or a second approved device and test it before the primary device is lost. Record the provider’s official account-recovery route in a secure place. Do not rely on a support phone number or link delivered in an unsolicited message.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Common mistakes and their fixes
Approving to make the alerts stop
Why it fails: the attacker is counting on annoyance and timing. Fix: deny the request, then investigate from the official service.
Assuming number matching stops phishing
Why it fails: a real-time phishing site can relay the sign-in and ask for the displayed number. Fix: use a passkey or security key where possible; treat number matching as an interim control.
Recommended Free Tools
Using SMS because it is familiar
Why it fails: SMS and voice methods remain vulnerable to phishing, SS7 attacks, and SIM swaps. Fix: move to FIDO/WebAuthn, then an authenticator app, and keep SMS only as a last resort when stronger methods are unavailable.
Enforcing a policy before enrollment
Why it fails: administrators or users can be locked out before they have a usable method. Fix: register, test, and document recovery first, then enforce the requirement.
Ignoring existing sessions
Why it fails: changing a password or MFA method may not terminate every session. Fix: review and revoke active sessions and connected devices after a suspicious prompt or confirmed compromise.
What the available evidence does—and does not—show
CISA’s October 2022 number-matching guidance supports the distinction between push-bombing resistance and phishing resistance: number matching helps with the former, while FIDO/WebAuthn is designed for the latter. Microsoft and Google document provider-specific options, and those options can change as platforms and account defaults evolve.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMicrosoft reports that 92% of its employee productivity accounts are protected by phishing-resistant authentication methods. The cited Microsoft page does not state a year for that figure, and it describes Microsoft’s own employee productivity accounts—not the general population, MFA-fatigue prevalence, or effectiveness across all organizations. No independent, topic-wide prevalence statistic or control-effectiveness estimate is established here.
For the safest practical decision, use phishing-resistant MFA wherever your account and devices support it, use number matching when that is the strongest available push option, and treat every unrequested prompt as a possible compromise.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
