Quick Summary
MFA is important, but scammers can abuse it by repeatedly sending prompts until you approve one. Stay alert, deny unexpected prompts, and report suspicious activity right away.
Multi-factor authentication, or MFA, is one of the best ways to protect your online accounts. It adds an extra layer of security by requiring you to approve login attempts through a code, app notification, phone call, text message, or email. However, MFA does not guarantee complete protection.
In MFA fatigue scams, cybercriminals already have your username and password. From there, they repeatedly trigger MFA prompts in hopes that you will approve one by mistake. These prompts may come through your authentication app, text messages, emails, or even phone calls.
The goal is simple: wear you down. After receiving several alerts, especially late at night or during a busy workday, you may click “approve” just to make the notifications stop. That single approval can give a scammer access to your account.
Scammers may also add pressure by pretending to be an IT or support representative. They may call, text, or email you and claim that you need to approve the prompt to protect your account, stop suspicious activity, or complete a system update. This is a red flag.
To stay safe, never approve an MFA prompt you did not request. If you receive an unexpected prompt, deny it, change your password immediately, and report the activity to your IT team or service provider. For shared accounts, always verify with the appropriate team before approving a login. You should also use strong, unique passwords for every account so one compromised password does not put multiple accounts at risk.