SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-push-bombing

What is push bombing, also called MFA fatigue?

Attackers flood you with approval prompts until you tap Accept.

Start playing free

  1. Attackers flood you with prompts until you tap Accept ✔
  2. A virus that drains your phone battery
  3. Hundreds of newsletters in your inbox

Why: The attacker already has your password and keeps triggering sign-in prompts. Some people tap Accept just to make them stop. If you did not sign in, always deny, and report it.

Huh, didn't know that: CISA says push bombing is also known as push fatigue.

The dad joke
My two-factor authentication is yelling the code across the room.
Like this card?
Play the game

References

Answer: Attackers flood you with prompts until you tap Accept. The attacker already has your password and keeps triggering sign-in prompts. Some people tap Accept just to make them stop. If you did not sign in, always deny, and report it.

  1. CISA: Implementing Phishing-Resistant MFA fact sheet www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
    Cyber threat actors bombard a user with push notifications until they press the “Accept” button
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich kind of MFA does CISA call the gold standard?Security & PrivacyCISA says the only widely available phishing-resistant sign-in method is what?Security & PrivacyWhich sign-in method does CISA list as vulnerable to phishing?

That's stuff everyone should know.