Don't Just Tap "Approve": How to Handle MFA Push Notifications Safely

Multi-factor authentication (MFA) is one of the best defences a business has. Your password alone isn't enough to get in, because a second step, usually a push notification on your phone, has to confirm it's really you.

That second step only works if someone actually reads it.

Attackers know that many people approve MFA prompts on autopilot. A notification pops up, you're in the middle of something, and you tap "Approve" just to make it go away. When that happens, a criminal who already has your password is let straight in, and MFA has done nothing to stop them.

How attackers exploit push notifications

The tactic is often called MFA fatigue or push bombing. An attacker who has stolen or guessed a password tries to log in again and again, sending a stream of approval requests to the real user's phone. They're betting that, sooner or later, the user will approve one by mistake, out of frustration, or because they assume it's a glitch.

Sometimes the attacker adds a phone call or message pretending to be from IT support: "We're fixing an issue on your account, please approve the prompt you're about to receive." It sounds helpful, but it's a trap.

The three-second check before you approve

Every time an MFA push notification appears, pause and ask yourself three questions.

1. Was I actually signing in just now? You should only expect a prompt when you have just tried to log in, for example opening Outlook on a new laptop, signing in to Microsoft 365 in a browser, or connecting to the VPN. If you weren't doing anything that would reasonably trigger a sign-in, the prompt isn't yours.

2. Does the timing make sense? A prompt that arrives while you're in a meeting, driving, asleep or on your lunch break, without you having touched a login screen, is a red flag. Legitimate prompts appear within seconds of you signing in, not out of the blue.

3. Do the location and app details match? Many authenticator apps, including Microsoft Authenticator, show extra information such as the app being accessed, the approximate location or country, and sometimes a map. Check it. If you're in Bedford and the request says it's coming from another country, or names an app you weren't using, don't approve it. Bear in mind that locations can be approximate, especially on mobile networks or VPNs, but a completely different country is a clear warning sign.

If your app asks you to type a number shown on the sign-in screen, only enter it when you can see that screen in front of you. If you can't see a number on your own device, you didn't start the sign-in.

If it was out of the blue, reject it

The rule is simple: if you weren't expecting it, deny it.

Tap "Deny" or "No, it's not me", and if your app offers a "Report" option, use it. Rejecting a genuine prompt by mistake costs you a few seconds while you sign in again. Approving a fake one can cost your business its email, its data and its reputation.

Then take these steps straight away:

• Tell your IT team or provider immediately. An unexpected prompt means someone may already have your password.

• Change your password, especially if you've used it anywhere else.

• Don't approve any further prompts until IT has confirmed it's safe, even if they keep coming.

• Be suspicious of anyone who contacts you asking you to approve a prompt. Genuine IT support will never ask you to approve an MFA request you didn't start.

What businesses can do

People are the last line of defence, but technology can make their job easier. We recommend:

• Number matching and additional context turned on in your authenticator app, so users see where a request is coming from and have to match a code

• Conditional access policies that block or challenge sign-ins from unexpected countries, devices or networks

• Phishing-resistant MFA, such as passkeys or FIDO2 security keys, for administrators and high-risk users

• Regular security awareness training, so "check, then approve" becomes second nature

• Monitoring and alerting on repeated MFA failures and denied prompts, so a push bombing attack is spotted and stopped quickly

The bottom line

MFA works, but only when every prompt gets a moment's attention. Before you tap Approve, ask yourself: Was that me, just now, from here? If the answer is anything other than a clear yes, reject it and report it.

If you'd like help reviewing your Microsoft 365 MFA settings, rolling out number matching and conditional access, or running security awareness training for your team, get in touch with Total IT.