At three financial institutions in the region we saw the same sequence within a quarter: credentials stolen via phishing, then a downpour of push notifications to the victim’s phone at 2 a.m. On the eighth request, the user approved, so the phone would let them sleep.
Anatomy of the attack
MFA fatigue is not sophisticated, which is why it works: the attacker already has the password, and traditional push only asks “approve?”. It doesn’t say from where, to what, or why at that hour. The victim isn’t evaluating risk, they’re trying to make the noise stop.
SIGNAL IN IDENTITY TELEMETRY
window : 10 minutes
condition : >= 5 denied or expired pushes for the same
user + 1 subsequent approval
enriched : origin geography vs. history ·
user local time · IP reputation
action : revoke session + force MFA re-registration + callThe 2 a.m. approval is not consent. It’s surrender.
What cuts it at the root
THE THREE LAYERS, BY IMPACT
- Number matching in the authenticator: the victim must type the number on screen, the attacker doesn’t have it.
- Burst detection in identity telemetry, with automatic session revocation on trigger.
- Targeted awareness: “if it wasn’t you, denying isn’t enough, report it”, measured by report rate.
In all three cases the burst detection fired before the user report. Containment, revoking the session and forcing factor re-registration, took under fifteen minutes from trigger. All three clients deployed number matching in the following weeks; the technique never reappeared in their telemetry.
