An MFA fatigue attack works by wearing a person down, not by breaking technology. The attacker already has a password. The only thing standing between them and a clinic’s email, EHR, or remote desktop is a prompt on a staff member’s phone, and they keep sending it until someone taps “Approve” just to make it stop.
It is 6:40 on a Monday morning, and a medical assistant is making coffee before the first patient.
Her phone buzzes. “Approve sign-in?”
She did not try to sign in. She is not at a computer. She taps “Deny” and puts the phone down.
It buzzes again. Then again. She denies two more. She assumes it is a glitch, probably something with the system update IT mentioned last week.
By 6:55, the phone has buzzed more than thirty times. By 7:05, it is at forty. She has a full schedule, a crying toddler in the waiting room, and a doctor asking about the first chart. The buzzing will not stop.
She taps “Approve.”
The prompts stop. The morning moves on.
Eleven minutes later, someone in another country signs in to the clinic’s email account as her. By lunchtime, a hidden rule is forwarding messages containing patient names to an outside address. By Wednesday, the same account has been used to request a patient list from the billing team.
Nothing about the morning looked like an attack. It looked like a nuisance.
What an MFA Fatigue Attack Is
The Cybersecurity and Infrastructure Security Agency describes MFA fatigue, also called push bombing, as an attack in which a threat actor bombards a user with mobile push notifications until the user approves a request by accident or out of annoyance with the nonstop notifications.
Understanding the order of events matters.
First, the attacker obtains a valid username and password. That can happen through a phishing email, malware that steals saved logins, a password reused from another breached website, or credentials bought from criminals who trade them. A password alone is not enough to get in, because the clinic has multifactor authentication.
Second, the attacker tries to sign in. The system sends a push prompt to the real user’s phone. The attacker cannot see the phone, but they can trigger the prompt as many times as they like.
Third, the attacker waits for someone to give in. Prompts at night, early morning, or in the middle of a busy clinic day all work well, because the target is tired, distracted, or in a hurry.
The technique does not defeat the encryption behind MFA. It defeats the human at the end of it.
Why Healthcare Staff Are Easy to Wear Down
Several features of clinical work make this attack especially effective.
Clinical staff are trained to respond quickly. Fast response to a request is a virtue in a clinic, and approving a prompt can feel like part of the routine.
Shift schedules, early starts, and interruptions mean prompts arrive when attention is at its lowest.
Many practices have staff who sign in from multiple places: the office, a hospital, a home laptop, a tablet in an exam room. Frequent legitimate prompts teach people to approve without reading.
And in a small practice, nobody may have told the front desk what an unexpected prompt means.
The result is a population of capable, conscientious people who have been unintentionally trained to treat prompts as noise.
No MFA Is Worse. Change Healthcare Showed How Much Worse.
It is important to be clear about the order of risk. Weak MFA is a problem, but no MFA is far more dangerous.
In February 2024, the ransomware group ALPHV used compromised credentials to access a Change Healthcare Citrix portal, a remote access application. UnitedHealth Group’s chief executive told Congress that the portal did not have multifactor authentication. Nine days later, the attackers deployed ransomware. The incident disrupted claims processing and payments for health care providers across the country and has been described as the most disruptive cyberattack on U.S. healthcare.
The lesson is not that every clinic is a Change Healthcare. It is that a single remote access path protected only by a password can become the entry point for an event that affects thousands of organizations. A practice that has MFA on email but not on its remote desktop, vendor access, or administrator accounts has the same weakness on a smaller scale.
What HIPAA Says
The HIPAA Security Rule’s technical safeguards include a standard titled person or entity authentication. It requires covered entities to implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.
The standard is technology neutral. It does not name multifactor authentication. But for any system holding patient information that is reachable from outside the building, a password alone is hard to defend as a procedure that verifies who is on the other end.
As discussed in earlier articles in this series, HHS has proposed an update to the Security Rule that would make multifactor authentication an explicit requirement, along with other measures. That proposal is still not final law. The practical direction is clear, though, and a practice that builds strong authentication now is preparing for both the current rule and the likely future one.
Not All MFA Is Equal
CISA ranks forms of multifactor authentication from strongest to weakest, and the ranking explains why push bombing works.
Phishing-resistant MFA is at the top. This means FIDO and WebAuthn authenticators, such as hardware security keys and passkeys, and certificate-based smartcards. They are bound to the real website, so they cannot be tricked into approving a fake login, and there is no “approve or deny” prompt to wear down. CISA calls it the gold standard and urges organizations to make migrating to it a high priority.
Next are one-time code apps and push notifications with number matching. These resist push bombing, because the user must type a number shown on the login screen into the app, which an attacker who cannot see that screen cannot supply. They remain vulnerable to phishing sites that relay the code in real time, a technique discussed in an earlier article in this series.
Below that is push notification without number matching. This is the form that push bombing was built to exploit, because the only action required is a tap.
At the bottom are text message and voice codes. They are open to phishing, to criminals who hijack phone numbers, and to attacks on the phone network.
CISA is consistent that any MFA is better than none. It recommends phishing-resistant MFA for all organizations, and says that if an organization cannot get there yet, it should turn on number matching as an interim measure.
What NIST’s Authentication Guidance Adds
NIST’s digital identity guidelines reinforce the same ordering. The current revision, finalized in 2025, says services that need two-factor authentication at its standard assurance level must offer at least one phishing-resistant option, and services that need the highest assurance must require phishing resistance. It classes text message codes over the phone network as the one restricted authenticator, and states that out-of-band authentication, which includes push-style approval, is not phishing resistant.
It also addresses the specific problem in this article. Services that send push notifications should apply a reasonable limit to the rate or total number of notifications sent since the last successful sign-in. Forty prompts in twenty minutes should never reach a user’s phone.
What Every Employee Should Know
The best defense against an MFA fatigue attack is a rule simple enough to remember at 6:55 in the morning.
If you did not just try to sign in, do not approve. An unexpected prompt means someone else has your password.
Deny it, and tell IT immediately. Even a single unexpected prompt matters. It is a warning that the password has been stolen.
Never approve a prompt to make it stop. Persistence is the attack. The buzzing will end the moment IT resets the account.
Never approve because someone asked you to. A caller, text, or message claiming to be IT support and asking you to accept a prompt is a major warning sign. Legitimate support does not need you to approve a login you did not start.
Report without fear. Employees who report an unexpected prompt, or admit they approved one by mistake, should be thanked. Speed is the difference between a reset and a breach, and an employee who is afraid of blame will wait.
These five points fit on an index card. Every new hire and every temporary worker should receive one.
What IT Should Configure
The technical controls are well understood and, in most modern systems, available as settings rather than new purchases.
Turn on number matching. For any push-based MFA, require the user to enter a number from the login screen. This single setting defeats basic push bombing.
Show context. Where the platform supports it, display the application and approximate location in the prompt, so a sign-in attempt from another country looks wrong at a glance.
Limit prompts. Configure rate limits and temporary lockouts so repeated prompts stop after a small number of attempts.
Block legacy sign-in methods. Older protocols that skip modern MFA give attackers a way around it.
Use conditional access. Restrict sign-ins by location, device health, and risk, so a password used from an unfamiliar device or country is stopped or challenged more strictly.
Move high-risk users to phishing-resistant MFA first. Administrators, billing and revenue staff, physicians with remote access, and anyone who can reach large volumes of patient information should use security keys or passkeys.
Cover every door. MFA should protect email, the EHR, remote desktop and VPN access, vendor access, cloud applications, and the administrator accounts for all of them. The Change Healthcare lesson is that the one door left unprotected is the one attackers find.
Alert on bursts of prompts. A flood of prompts for one account in a short period is a high-confidence sign of an attack in progress.
CISA also advises investigating denied prompts. A denied request the user did not initiate means someone has the password, which should trigger a password reset and a review of the account.
Reduce the Stolen Password Problem Too
Push bombing begins with a stolen password, so reducing stolen passwords reduces the attack.
Use a unique password for every account, supported by a business password manager, so one breached website does not unlock the clinic. Train staff to recognize phishing and to avoid saving work passwords in personal browsers. Keep work devices free of personal software that steals credentials. Monitor for staff credentials appearing in breach data, and reset any that do.
No single measure is enough. Strong authentication and strong password hygiene work as a pair.
If Someone Already Approved
Assume an approval means the account is compromised, and act within minutes.
Reset the password and revoke all active sessions and tokens, so the attacker is signed out everywhere.
Check the account’s registered authentication devices. Attackers who get in can add their own device so they can return.
Review email for hidden forwarding rules and for messages sent or deleted that the user did not send or delete.
Review audit logs in the EHR and other systems for access, searches, or exports by that account.
Determine whether protected health information was accessed. If it was, HIPAA’s breach notification rule and Florida’s thirty-day notice deadline to affected individuals may both apply, and the practice’s counsel should assess the obligations. The incident, the assessment, and the response should all be documented.
A tested incident response plan makes these steps routine, and, as discussed in an earlier article in this series on cyber insurance, carriers increasingly ask whether such a plan exists.
Make Someone Responsible for Watching
Strong settings drift. A new application gets added without MFA, an exception granted during a busy week never gets removed, and a vendor account is created with only a password.
Assign an owner for authentication, whether it is a practice administrator working with an outside managed IT services partner or a designated internal lead. That owner reviews which systems are covered by MFA, confirms that number matching and prompt limits remain on, checks the list of registered devices, and receives the alert the same day when an account sees a burst of prompts. A short quarterly review, added to the same calendar as the HIPAA risk analysis updates discussed earlier in this series, keeps the protections from quietly eroding.
What This Means for Miami and South Florida Practices
Several local conditions can make this attack easier or more damaging here.
Many South Florida physicians practice across multiple sites, including their own office, one or more hospitals, and surgical centers. Each has its own logins and prompts, which can normalize frequent approvals and make a fraudulent one blend in.
Clinics often start early, and staff arrive to full schedules, so prompts at dawn or midday meet a distracted audience.
The workforce is bilingual, and security training that exists only in English leaves some staff with less clarity about what to do. The one-card rule above should be available in both languages.
Hurricane season shifts staff to remote work on short notice, multiplying remote sign-ins just when authentication settings are most likely to be loosened or skipped.
And the region’s large number of independent practices means many have a part-time or outsourced IT resource, so settings such as number matching and rate limits may never have been reviewed.
Ask Your IT Provider Questions Like These
Is number matching turned on for every push-based multifactor prompt in our environment?
Do we limit how many prompts a user can receive, and do we alert when one account receives a burst?
Is multifactor authentication enforced on every external access path, including remote desktop, VPN, email, the EHR, and vendor access?
Have we moved administrators and high-risk users to security keys or passkeys, and what is our plan for everyone else?
Have legacy sign-in methods been blocked?
Do staff know what to do when they receive an unexpected prompt, and who to tell?
If your IT provider cannot answer these clearly, the next buzzing phone may be the one that gets approved.
The Prompt Is Not the Problem. The Password Behind It Is.
An unexpected prompt is a gift. It is the one moment a stolen password announces itself. Practices that train staff to treat it as an alarm, and configure their systems to make approval hard to abuse, turn the attacker’s best move into the practice’s early warning.
ITva Technologies provides managed IT and cybersecurity services for medical practices across Miami-Dade and Broward, with specific experience hardening authentication in the environments where clinical staff actually work.
Our managed IT services include configuring number matching, rate limits, conditional access, and the removal of legacy sign-in methods across email, remote access, and cloud applications.
Our cybersecurity services include rolling out phishing-resistant authentication for high-risk users, monitoring for bursts of prompts and unusual sign-ins, and training staff on the simple rule that stops this attack.
Because many practices already use Microsoft cloud tools, our Microsoft 365 services also review the identity settings that control how those prompts behave.
If your practice has never checked whether number matching and prompt limits are on, that is worth doing before the next early morning.
Schedule a free authentication security assessment with ITva.
We will review how your staff sign in, where MFA is missing or weak, and what a stolen password could reach today.
Because the phone will buzz again.
Everyone in your practice should know what it means.
Frequently Asked Questions
What is an MFA fatigue attack?
It is an attack in which someone who already has a user’s password repeatedly triggers push notifications to the user’s phone until the user approves one by accident or out of annoyance. It is also called push bombing or prompt bombing.
What should an employee do if they get an unexpected MFA prompt?
Deny it and report it to IT immediately. An unexpected prompt means someone has the password. The employee should never approve a prompt just to make it stop, or because a caller or message asked them to.
Does number matching stop MFA fatigue attacks?
It stops basic push bombing because the user must type a number shown on the login screen, which the attacker cannot see. CISA recommends it as an interim measure when phishing-resistant MFA is not yet possible, while noting it does not stop phishing sites that relay codes.
What is phishing-resistant MFA?
It is authentication that is cryptographically bound to the real website, such as FIDO and WebAuthn security keys and passkeys, or certificate-based smartcards. It cannot be tricked by a fake login page, and it eliminates the approve-or-deny prompt that push bombing exploits.
Does HIPAA require multifactor authentication?
The Security Rule requires procedures to verify that a person seeking access to protected health information is the one claimed, without naming a specific technology. HHS has proposed an update that would make multifactor authentication explicit, but it is still a proposed rule, not final law.
What happened in the Change Healthcare attack?
In February 2024, criminals used compromised credentials to access a Change Healthcare Citrix remote access portal that did not have multifactor authentication, according to testimony from UnitedHealth Group’s chief executive. They deployed ransomware nine days later, disrupting claims processing across the health care system.