MFA bypass: fatigue attacks, push bombing, and SIM swapping

Push bombing floods users with MFA approval requests until they click "approve" to stop the barrage. In 2023, Cisco's network suffered a breach after attackers wore down an employee with constant push notifications. Threat actors bypass multi-factor authentication through three primary attack vectors that target user behavior and telecommunications infrastructure rather than cryptographic weaknesses.

Attack surfaces and threat vectors

Push notification fatigue

Attackers obtain valid credentials through phishing, credential stuffing, or password spraying, then trigger authentication attempts that generate push notifications on the victim's device. The attack succeeds when users approve requests to stop the notifications or approve legitimate-looking requests mixed with malicious ones.

Standard push notifications display minimal information — often just "Approve" or "Deny" buttons with basic location data. This creates conditions where users cannot distinguish legitimate authentication attempts from malicious ones. The business consequence: a compromised password becomes equivalent to full account access.

Implementing number matching or biometric confirmation before push approval changes the outcome. Organizations can also restrict push notifications to specific time windows or require additional verification for requests outside normal business hours.

SIM Swapping Infrastructure Attacks

SIM swapping transfers a victim's phone number to an attacker-controlled device through social engineering telecommunications carrier support staff or exploiting carrier authentication systems. Once attackers control the victim's phone number, they receive SMS codes sent during authentication attempts.

This attack creates specific risk when organizations rely on SMS as a primary or fallback authentication factor. High-value targets face particular vulnerability because carriers may not verify identity adequately before processing SIM transfer requests. Detection becomes difficult because legitimate SIM swaps occur regularly due to device upgrades and carrier changes, creating a detection gap when organizations cannot distinguish malicious transfers from legitimate ones without additional telemetry correlation.

Push bombing scale attacks

Push bombing amplifies fatigue attacks by generating hundreds or thousands of push notifications within short time windows. Attackers use automated tools to trigger repeated authentication attempts, overwhelming users with constant notifications until they approve a request to end the disruption.

The business consequence: legitimate users cannot access systems due to notification overload, creating both security and availability risks. Organizations often see success rates increase when attacks occur during high-stress periods or outside business hours when users may approve requests without careful review. Large volumes of failed authentication attempts may trigger security alerts, but the eventual successful approval appears as a normal authentication event.

Detection guidance

Volume-based detection patterns

Monitor for authentication patterns that indicate systematic MFA abuse attempts:

# Logic pattern / pseudocode — validate for your platform
# Push notification volume anomaly detection
SELECT user_id, COUNT(*) as push_count, 
 MIN(timestamp) as first_push, MAX(timestamp) as last_push
FROM mfa_events 
WHERE event_type = 'push_sent' 
 AND timestamp >= NOW() - INTERVAL '1 HOUR'
GROUP BY user_id
HAVING COUNT(*) > 10

# Logic pattern / pseudocode — validate for your platform 
# MFA approval after multiple denials
SELECT user_id, session_id, 
 SUM(CASE WHEN action = 'deny' THEN 1 ELSE 0 END) as denials,
 SUM(CASE WHEN action = 'approve' THEN 1 ELSE 0 END) as approvals
FROM mfa_responses
WHERE timestamp >= NOW() - INTERVAL '5 MINUTES'
GROUP BY user_id, session_id
HAVING denials > 3 AND approvals > 0

Temporal pattern detection

Identify authentication attempts that deviate from established user patterns:

# Logic pattern / pseudocode — validate for your platform
# Out-of-hours MFA approvals
SELECT user_id, timestamp, source_ip, device_id
FROM successful_authentications sa
JOIN user_work_patterns uwp ON sa.user_id = uwp.user_id
WHERE EXTRACT(hour FROM sa.timestamp) NOT BETWEEN uwp.start_hour AND uwp.end_hour
 OR EXTRACT(dow FROM sa.timestamp) IN (0, 6) -- Weekend activity
 AND sa.mfa_method = 'push_approval'

SIM swap correlation detection

Correlate telecommunications events with authentication activity when carrier APIs or internal IT ticketing systems provide SIM change notifications:

# Logic pattern / pseudocode — validate for your platform
# Authentication following SIM changes
SELECT sc.phone_number, sc.change_timestamp, 
 auth.timestamp as auth_timestamp, auth.user_id
FROM sim_changes sc
JOIN user_phone_numbers upn ON sc.phone_number = upn.phone_number 
JOIN authentications auth ON upn.user_id = auth.user_id
WHERE auth.timestamp BETWEEN sc.change_timestamp AND sc.change_timestamp + INTERVAL '24 HOURS'
 AND auth.mfa_method IN ('sms', 'voice_call')

Required log sources include identity provider authentication logs, MFA service logs, and telecommunications change notifications where available. Detection effectiveness depends on correlating events across these data sources within specific time windows.

Mitigation strategies

Primary control: phishing-resistant MFA implementation

WebAuthn-based authenticators, smart cards, and FIDO2 tokens prevent remote attackers from completing authentication even with valid credentials. These factors require cryptographic proof of presence that push notifications and SMS cannot provide.

Higher implementation complexity and user training requirements trade off against elimination of remote bypass risks. Organizations should prioritize phishing-resistant factors for privileged accounts and sensitive systems first, then expand coverage based on risk assessment.

Push notification hardening

Number matching requirements display codes users must enter to approve authentication requests. This control prevents automated approval of notifications and requires attackers to communicate displayed numbers to victims.

Configure push notifications to include additional context such as requesting application, geographic location, and device type. This information helps users identify malicious authentication attempts that originate from unexpected locations or applications.

SMS and voice call restrictions

SMS and voice calls as standalone authentication factors create vulnerability to SIM swapping attacks. Configure these methods only as backup options that require additional approval workflows or administrative intervention.

Carrier-independent verification for SIM changes through enterprise mobility management platforms can detect device changes. The operational limitation requires organizations to balance security controls with legitimate device replacement workflows.

Fraud monitoring integration

Integrate authentication events with telecommunications fraud monitoring services that detect SIM swap activities. Some carriers and third-party services provide APIs that report recent SIM changes, though coverage varies by provider and geographic region.

Configure alerts when authentication attempts follow telecommunications changes within defined time windows. This correlation helps identify potential SIM swapping attacks before they succeed against multiple accounts.

Getting started checklist

Immediate actions (Week 1)

Short-term implementation (Weeks 2-4)

Medium-term migration (Months 1-3)

Validation testing (Ongoing)

The checklist prioritizes immediate risk reduction through detection and push notification hardening before progressing to longer-term migration toward phishing-resistant factors. Organizations should adjust timelines based on user population size and technical infrastructure constraints.

Sources