Accounts
Approval-bombing (MFA fatigue)
In Turkish: Onay bombardımanı (MFA yorgunluğu)
An attacker who has your password floods your phone with login approval requests, hoping you tap Approve just to make them stop.
If your second step is a tap on a prompt, the attacker only needs you to tap once, at night or by mistake. A prompt you did not start means someone else has your password.
Deny every request, then change the password and sign out other devices. If your app can show a number to match, or you can use a passkey or an authenticator code, prefer those.
What to do
- Never approve a prompt you did not start yourself.
- Deny them all, then change the password right away.
- Switch to a code or passkey if prompts keep arriving.