How to Respond to an MFA Fatigue Attack: Incident Response Guide for Interventional Pain Practices

MFA Fatigue Attack Definition

What it is

An MFA fatigue attack—often called push bombing—floods you with multi-factor authentication prompts to coerce a single mistaken approval. The attacker already knows or guessed your password and weaponizes prompt overload to bypass MFA and take over the account.

Why interventional pain practices are targeted

Your practice manages ePHI, e-prescribing, imaging, and scheduling systems that run on cloud identities. Small teams, after-hours on-call work, and mobile devices make you more vulnerable to prompt spam and social engineering that can interrupt patient care.

Attack Mechanism

Common pathways

• Credential theft via phishing, password reuse, or infostealer malware.
• Attacker signs in and repeatedly triggers push approvals or SMS codes.
• Escalation with phone calls or texts pretending to be IT to “approve once.”

The role of multi-factor authentication prompts

Attackers exploit human factors: fatigue, interruptions, and trust in familiar apps. Even number-matching can be defeated if users are manipulated to enter the displayed code.

Persistence and privilege

• Session persistence through refresh tokens; without session revocation, access can continue after password resets.
• OAuth privilege escalation by tricking users into consenting to a malicious app or by abusing weak consent policies to gain broader API access.

Indicators of an MFA Fatigue Attack

User-facing signals

• Unsolicited multi-factor authentication prompts—especially at unusual hours.
• Repeated prompts across multiple devices or channels (push, SMS, phone).
• Unexpected calls claiming to be “IT” asking you to approve a prompt.
• Login alerts from unfamiliar locations, IPs, or devices.

Admin-facing telemetry

• Sign-in log analysis shows bursts of MFA challenges, “denied” or “fraud reported” events, and failed attempts from hosting providers or atypical ASNs.
• New or suspicious OAuth app consents; device code flow sign-ins; anomalous session creation.
• Post-compromise trails: new inbox rules, odd e-prescribe activity, unfamiliar file sharing, or admin role assignments.

Immediate Response Steps for Users

Your 60-second action plan

• Do not approve any prompt. If available, tap “Deny” or “Report” to flag push bombing.
• Stop the noise: temporarily enable airplane mode or Do Not Disturb on your phone.
• Use out-of-band verification: call your practice’s known helpdesk number (don’t use numbers from texts or callers) to report an MFA fatigue attack.
• From a known-clean device, change your account password only after IT confirms it’s safe to do so.
• If you accidentally approved, state that immediately—time is critical to revoke sessions.

What to report to helpdesk

• Exact times, number of prompts, and the device(s) receiving them.
• Screenshots of prompts or caller IDs, if safe to capture.
• Your last legitimate sign-in, current location, and whether you clicked links recently.

Immediate Response Steps for Administrators

First 15 minutes: contain

• Confirm the target account; communicate with the user via out-of-band verification.
• Block sign-in for the account and require password reset; immediately perform session revocation (revoke refresh tokens and sign out active sessions).
• Place temporary IP blocks or conditional access to stop ongoing push bombing from known attacker sources.

First hour: investigate and eradicate

• Perform sign-in log analysis: map failed and successful MFA attempts, device code flow usage, locations, user agents, and hosting IPs.
• Audit authentication method changes, app password creation, mailbox rules, and admin role assignments.
• Review OAuth grants; remove suspicious apps and disable user consent or restrict it to verified apps to prevent OAuth privilege escalation.
• Check EHR, e-prescribe, imaging/PACS, and file share logs for unauthorized access or data exfiltration indicators.
• Isolate suspected endpoints with EDR; scan and remediate.

Recovery and hardening

• Force re-registration of MFA; prefer phishing-resistant MFA (FIDO2 security keys or platform passkeys) over push or SMS.
• Re-issue new credentials for integrated systems and rotate keys/secrets used by service accounts.
• Document the timeline, impacted systems, and decisions; notify your privacy/security officer to assess regulatory obligations.

Preventive Measures for MFA Fatigue Attacks

Strengthen authentication

• Adopt phishing-resistant MFA for clinicians and staff; use security keys or passkeys wherever possible.
• If push is retained, enable number matching, display location and application context, and cap prompt frequency with cooldowns.
• Disable voice call MFA and minimize SMS reliance; prefer authenticator apps or hardware-backed methods.

Reduce the attack surface

• Harden consent: restrict user consent, require admin review, and pre-approve only vetted apps to curb OAuth privilege escalation.
• Disable legacy protocols and unneeded device code flows; enforce least privilege on all roles.
• Shorten token lifetimes where feasible and enforce sign-in frequency to limit exposure from stolen sessions.

Monitor and drill

• Enable high-fidelity alerts for MFA fraud reports, prompt storms, and impossible travel; centralize telemetry for rapid sign-in log analysis.
• Rehearse runbooks: user denials, session revocation, and rapid comms during clinic hours and after-hours coverage.
• Provide quarterly micro-trainings on push bombing and out-of-band verification.

Helpdesk Protocols and Security Best Practices

Identity verification and caller handling

• Never accept codes or approvals over inbound calls. Call users back via a known internal number to perform out-of-band verification.
• Use multi-field verification (employee ID, manager, last successful sign-in location) and a one-time code delivered through a separate trusted channel.

Reset and recovery safeguards

• When an MFA fatigue attack is suspected, enforce password reset plus session revocation before re-enabling sign-in.
• Require re-enrollment into phishing-resistant MFA; temporarily block push until secure enrollment is complete.
• Create a short-term conditional access policy for the affected user (e.g., trusted network only) during recovery.

Documentation and escalation

• Open an incident ticket with precise timestamps, artifacts, and actions taken; tag it as “push bombing/MFA fatigue.”
• Run a blast-radius checklist: OAuth apps, inbox rules, admin roles, data access, and endpoint health.
• Brief leadership and the privacy officer; record decisions and patient-care impacts.

Conclusion

MFA fatigue attacks exploit human attention, not just technology. By training users to deny unsolicited prompts, enforcing phishing-resistant MFA, using out-of-band verification, performing rapid sign-in log analysis, and executing immediate session revocation, your interventional pain practice can contain threats quickly and prevent recurrence.

FAQs.

What is an MFA fatigue attack?

It is a social-engineering technique where attackers repeatedly trigger MFA prompts—push bombing—until a user accidentally approves. One mistaken tap can create a valid session the attacker exploits.

How can users recognize an MFA fatigue attack?

Watch for waves of unsolicited multi-factor authentication prompts, especially at odd hours, and calls or texts pressuring you to approve “just once.” If you did not initiate a sign-in, deny and report it.

What immediate actions should be taken during an MFA fatigue attack?

Deny all prompts, put your phone in airplane mode to stop the flood, and call your helpdesk via a known number for out-of-band verification. From a clean device, change your password only after IT initiates session revocation.

How can interventional pain practices prevent MFA fatigue attacks?

Adopt phishing-resistant MFA (security keys or passkeys), restrict OAuth consent, set push limits with number matching, monitor for prompt storms via sign-in log analysis, and rehearse runbooks that include rapid session revocation and clear helpdesk protocols.