MFA Fatigue Attacks: What Financial Firms Must Know
Key Takeaways
MFA fatigue attacks exploit push-based authentication by bombarding employees with approval requests until they give in—and financial firms are prime targets. This article explains how these attacks work and why enabling MFA alone is no longer sufficient protection against modern credential-based threats.
Your firm probably enabled multi-factor authentication and considered that box checked. It was a reasonable decision — MFA blocks the vast majority of credential-based attacks. But attackers have adapted, and a technique called MFA fatigue is now being used to bypass exactly the controls your firm put in place to feel secure.
This isn’t a theoretical risk. High-profile breaches at major organizations — including a 2022 compromise at a large authentication provider that exposed customer data across hundreds of downstream companies — were executed not by breaking encryption or exploiting obscure software flaws, but by simply exhausting a human being until they clicked “Approve.”
Financial firms are not immune. In fact, they may be more exposed than they realize.
Why Multi-Factor Authentication Is No Longer Enough on Its Own
Multi-factor authentication — the security practice of requiring a second proof of identity beyond a password, such as a code sent to your phone or a push notification you approve — remains one of the most effective defenses against account takeover. No serious security professional is arguing against it.
The problem is that MFA was widely deployed in a specific form: push notifications. An employee enters their password, and a prompt appears on their phone asking them to tap “Approve.” It’s fast, frictionless, and convenient. It’s also the exact mechanism that MFA fatigue exploits.
Convenience and security are often in tension, and push-based MFA leaned heavily toward convenience. That design choice is now being weaponized.
The broader lesson here isn’t that MFA is bad — it’s that any control becomes a target once it’s widely adopted. Attackers follow the path of least resistance, and right now, that path runs directly through the approve button on an employee’s smartphone.
How MFA Fatigue Attacks Work — and Why Financial Firms Are Prime Targets
The mechanics are straightforward, which is part of what makes this so dangerous.
An attacker obtains an employee’s username and password — through phishing (a deceptive email or message designed to steal credentials), a data breach from another service where the employee reused a password, or credential-buying on dark web markets. With credentials in hand, they begin logging into your systems repeatedly, triggering a flood of push notification requests to the employee’s phone.
The goal isn’t to guess a code. The goal is to wear the employee down.
- Notifications arrive at 11 p.m., 2 a.m., 6 a.m.
- Dozens of requests flood the phone over hours or days.
- The employee, assuming it’s a system glitch or simply desperate to stop the interruptions, taps “Approve.”
- The attacker is in.
In some variants, the attacker contacts the employee directly, impersonating IT support and claiming the approvals are needed to fix a technical issue. This social engineering layer — manipulating people rather than systems — makes the attack even more effective.
Financial firms are prime targets for several reasons:
- High-value data concentration. Your systems hold portfolio positions, capital call schedules, LP contact information, deal flow pipelines, and wire transfer instructions — all of which can be monetized or exploited.
- Lean operations. Many hedge funds and PE firms run with small internal teams, meaning a single compromised account can carry significant access privileges.
- Time-pressure culture. Financial professionals are conditioned to act quickly and approve requests without friction. Attackers exploit that conditioning.
- Credential exposure from phishing. Financial services firms are among the most heavily phished industries, creating a steady supply of stolen credentials that attackers can pair with fatigue techniques.
A managing director approving what they assume is a routine IT prompt at midnight is not a failure of intelligence — it’s a predictable human response to a system designed to exploit exhaustion.
The Regulatory and Investor Due-Diligence Stakes
A successful MFA fatigue attack isn’t just an IT problem. It carries consequences that reach into the compliance office, the LP relationship, and potentially the SEC examination room.
SEC and FINRA expectations have evolved. The SEC’s cybersecurity rules now require registered investment advisers and broker-dealers to have written policies addressing access controls and to disclose material cybersecurity incidents. An account takeover that exposes client data or disrupts operations is precisely the kind of event regulators will scrutinize — and “we had MFA enabled” will not be a sufficient answer if the MFA implementation had known weaknesses.
Investor due diligence questionnaires — the detailed operational reviews that institutional LPs and allocators conduct before committing capital — increasingly ask specific questions about cybersecurity controls. Sophisticated allocators are no longer satisfied with a yes/no answer on MFA. They want to know what kind of MFA, whether phishing-resistant methods are in place, and how the firm responds to credential compromise.
A breach that becomes known during a fundraise or re-up cycle can be deeply damaging — not because of the technical incident itself, but because of what it signals about operational maturity.
Cyber-insurance underwriters are asking similar questions. Firms that cannot demonstrate modern, phishing-resistant authentication practices are seeing higher premiums, coverage exclusions, or outright declinations at renewal.
Stronger Defenses Your IT Team Should Put in Place Now
The answer to MFA fatigue isn’t to abandon multi-factor authentication — it’s to upgrade how it’s implemented. Require your IT team or managed service provider to evaluate the following:
Move to phishing-resistant MFA methods. Not all MFA is equal. Push notifications are the weakest common form. Stronger alternatives include:
- Hardware security keys — physical devices that plug into a USB port or tap against a phone, which cannot be approved remotely by an attacker.
- Passkeys and FIDO2-based authentication — a modern standard (FIDO2 is an open framework that ties authentication to the specific website or application, making stolen credentials useless on fake sites) that is increasingly supported by major platforms.
Enable number matching and additional context on push notifications. If push notifications remain in use for any systems, ask your IT team whether number matching is turned on. This requires the employee to type a code displayed on the login screen into their phone — a small step that eliminates blind approvals.
Set limits on failed authentication attempts. Ask whether your systems are configured to alert your security team or lock an account after a high volume of MFA requests are denied in a short window. This is a basic detection control that can catch a fatigue attack in progress.
Audit which accounts have broad access privileges. The damage from a compromised account scales with what that account can reach. Require a review of which employees have access to wire transfer systems, investor data, and deal-room files — and ensure that access is scoped to only what each role genuinely requires.
Add targeted security awareness for this specific threat. Generic phishing training often misses the nuance of social engineering attacks. Ensure your team understands what a legitimate IT request looks like versus what an attacker impersonating IT will say — and that employees know they can and should refuse an unexpected MFA prompt rather than approve it to make it stop.
Final Thought
Multi-factor authentication was a meaningful step forward, and firms that still haven’t deployed it face far more immediate risks. But the security landscape moves, and the firms that treat MFA as a destination rather than a baseline are now carrying a vulnerability they may not see until it’s too late.
The right question to bring to your IT lead isn’t “do we have MFA?” — it’s “what kind of MFA do we have, and can it be bypassed by someone with patience and a phone number?” The answer to that question will tell you a great deal about where your firm actually stands.
Frequently Asked Questions
How does an MFA fatigue attack actually work against a financial firm?
An attacker obtains an employee’s username and password — through phishing, a third-party data breach, or dark web credential markets — then repeatedly attempts to log in, triggering a flood of push notification approval requests to the employee’s phone. Requests often arrive overnight or across multiple hours until the employee, assuming a system glitch or simply trying to stop the interruptions, taps ‘Approve.’ In more sophisticated variants, the attacker simultaneously contacts the employee by phone or message, impersonating IT support and claiming the approvals are needed to resolve a technical issue. Once the employee approves a single request, the attacker gains full account access.
Why are hedge funds and private equity firms especially vulnerable to MFA fatigue attacks?
Hedge funds and PE firms concentrate extremely high-value data — portfolio positions, wire transfer instructions, LP contact information, and deal flow pipelines — in systems often managed by small internal teams where a single compromised account carries broad access privileges. Financial professionals are also conditioned to act quickly and approve requests without friction, a behavioral pattern attackers deliberately exploit. Financial services is among the most heavily phished industries, which creates a steady supply of stolen credentials that attackers can pair with fatigue techniques. Lean operations mean fewer layers of internal review to catch an account takeover in progress.
What does the SEC now require from registered investment advisers regarding MFA and access controls?
The SEC’s cybersecurity rules require registered investment advisers to maintain written policies addressing access controls and to disclose material cybersecurity incidents. An account takeover that exposes client data or disrupts firm operations qualifies as the type of incident regulators will scrutinize during examinations. Demonstrating that MFA was enabled is not sufficient if the implementation relied on push notifications — a method with a known, documented weakness. Advisers should be prepared to describe the specific type of MFA deployed and whether phishing-resistant methods are in place.
What is the difference between push-based MFA and phishing-resistant MFA?
Push-based MFA sends a notification to an employee’s phone asking them to tap ‘Approve,’ which can be exploited by an attacker who simply floods the employee with requests until one is accepted. Phishing-resistant MFA methods — such as hardware security keys and FIDO2-based passkeys — tie authentication cryptographically to the specific application or website, so stolen credentials cannot be used on a fake site and an attacker cannot trigger remote approvals. Hardware security keys are physical devices that must be physically present during login, eliminating the remote approval vector entirely. FIDO2 is an open authentication standard increasingly supported by major identity platforms.
How do institutional LP due diligence questionnaires assess MFA controls?
Sophisticated institutional allocators have moved beyond yes/no questions about whether MFA is enabled and now ask specifically what type of MFA is deployed, whether phishing-resistant methods are in use, and how the firm responds to credential compromise events. A breach that surfaces during a fundraise or re-up cycle can signal operational immaturity even if the technical damage was contained. Cyber-insurance underwriters are asking parallel questions at renewal, with firms unable to demonstrate modern authentication practices facing higher premiums, coverage exclusions, or declinations.
What is number matching in MFA push notifications and does it stop fatigue attacks?
Number matching requires an employee to type a numeric code displayed on the login screen into their mobile authenticator app before the approval is accepted, replacing the blind one-tap ‘Approve’ button. This eliminates the core mechanism of MFA fatigue attacks, because an employee receiving an unexpected push notification has no code to enter and cannot inadvertently approve an attacker’s login attempt. Number matching is a configuration option available in major identity platforms and can be enabled without replacing the underlying push notification infrastructure. It is a meaningful interim control for firms that cannot immediately migrate to hardware keys or FIDO2 authentication.
What account-level detection controls can catch an MFA fatigue attack before access is granted?
Configuring identity systems to alert the security team or temporarily lock an account after a high volume of denied MFA requests within a short time window is a foundational detection control for fatigue attacks. This threshold-based alerting treats a burst of repeated failed authentication attempts as an anomaly requiring investigation rather than routine noise. Firms should confirm with their IT team or managed service provider that these limits are actively configured, not just available in the platform, since default settings often do not enable them. Combining alert thresholds with an access review — ensuring compromised accounts have only the minimum necessary permissions — limits the blast radius if an approval is granted before the alert fires.
Should a financial firm’s employees ever approve an unexpected MFA push notification they did not initiate?
No — employees should decline any MFA push notification they did not personally trigger by initiating a login. An unexpected approval request is a direct signal that someone else holds the account’s credentials and is attempting to authenticate. Security awareness training at financial firms should explicitly cover this scenario, including the social engineering variant where an attacker impersonating IT support contacts the employee and claims the approval is needed to fix a technical issue. Employees need to know that refusing an unexpected prompt is the correct action, and that a legitimate IT team will never ask them to approve a request they did not initiate.