Two in the Morning, One Tap: Why Your MFA Gets Talked Into Letting the Wrong Person In

It's 02:14 on a Tuesday and a phone on a bedside table lights up. Sign-in request. Approve or deny. The person holding it is a project manager at a 34-person engineering consultancy in the Midlands. She's half asleep, she doesn't recognise the location, and she taps deny. Good instinct.

Ninety seconds later it buzzes again. Deny. Again. Deny. The fourth one she approves, because it's quarter past two in the morning and the only thing she wants is for the buzzing to stop.

By the time she's at her desk, the attacker has a live session, a mailbox rule quietly forwarding invoices to an external address, and a list of the firm's clients. Her password was fine. MFA was switched on. The control worked exactly as designed and the business still lost a week to it.

MFA is a gate, not a wall

Most small business owners have absorbed the message that multi-factor authentication is essential. That's true. What doesn't get said often enough is that MFA is a decision point, and decision points can be worn down. There are three ways this happens in practice, and none of them involve breaking encryption.

Push bombing (sometimes called MFA fatigue) is the one above. The attacker already has a valid password — usually from a breach dump or a credential-stealing malware infection on a personal laptop — and simply asks, repeatedly, until somebody says yes.

SIM swapping is slower and nastier. Someone rings the mobile network pretending to be the account holder, gets the number ported to a SIM they control, and now receives your text codes. It happens more often than most people think, and it is the main reason security people wince when they see SMS as the only second factor.

Real-time phishing is the elegant one. A convincing copy of your Microsoft or Google login page sits in front of the real one, and when the employee signs in, the proxy passes the credentials through, prompts for the code, captures the session cookie, and never needs to ask again. MFA was satisfied. It just wasn't satisfied by your employee.

What it looks like in a 30-person firm

Almost none of these businesses have a security team. They have an operations manager who is also the IT person, a Microsoft 365 tenancy somebody set up in a hurry, a VPN, and a shared inbox for accounts@ that four people can access.

That estate is perfectly attackable. The credentials come from somewhere else entirely — a password reused on a fitness app, an infostealer on a teenager's gaming PC — and the first the firm knows is a flurry of sign-in alerts, or a client ringing to ask why the bank details on an invoice have changed.

The habits that do the damage

Blaming the person who tapped approve is easy and useless. The habits that set it up are organisational.

• 'It's just the VPN, just approve it.' Repeated prompts train people to comply. Every annoying but legitimate prompt makes the malicious one harder to spot.
• Shared logins. If four people use the same accounts@ credentials, a prompt on one phone is 'probably someone else'. MFA stops meaning anything.
• No alerting. Nobody sees the failed attempts at 02:00, so the first prompt and the fortieth look the same.
• SMS for everything. Cheap, familiar, and the weakest of the mainstream options.

Four upgrades, cheapest first

1. Number matching. Free, and Microsoft turned it on by default for Authenticator back in 2023 — but tenancies get built by whoever had five minutes, and policies get switched off. Check it's actually enabled. It removes the tap-to-approve reflex entirely: the app shows a two-digit number you have to type into the login screen.

2. Stop using SMS for anything sensitive. You may not be able to ban it outright, but you can insist on app-based or passkey methods for admins, finance and anyone who can approve payments.

3. Passkeys. Free, phishing-resistant, and increasingly well supported across Microsoft and Google accounts. A passkey is bound to the real website, so a lookalike login page gets nothing. The blockers are recovery flows and shared devices — sort those before you switch everyone on.

4. Hardware security keys. A FIDO2 key costs roughly £45–£60. Buy two per person for the handful of roles that matter — admins, finance, anyone who can move money — because the whole point is that losing one isn't a catastrophe. These are the strongest option available to a small business and they are not expensive.

The bits around the login

Authentication is only half of it. Turn off legacy authentication protocols, because they bypass MFA entirely. Put conditional access policies in place — restricting sign-ins to the UK if you never travel, blocking impossible-travel sign-ins, forcing re-authentication for admin portals. Microsoft charges around £5 per user per month for the licence tier that unlocks most of this in the UK; check with your reseller because pricing moves.

And switch on sign-in risk alerting to an inbox somebody actually reads. A push-bombing attempt generates a very distinctive pattern of failed sign-ins in a short window. Seeing it at 02:15 is worth a lot more than seeing it in a monthly report.

A six-week rollout that won't stall

Most MFA projects die in week two because they try to do everything at once.

• Week 1: Inventory. What methods is everyone using? Who has SMS only? Who's an admin?
• Week 2: Switch on number matching, kill legacy auth, brief everyone in one short email written in English.
• Week 3: Move admins and finance to hardware keys. Two each, registered, spares logged.
• Week 4: Offer passkeys to everyone else, with a drop-in session for the people who'll struggle.
• Week 5: Conditional access in report-only mode, then live once you've read the false positives.
• Week 6: Run a tabletop. Send a fake prompt-bomb to the team and see who reports it.

What to tell people, twice

The message that actually changes behaviour is short: never approve a sign-in you didn't start yourself. Decline it, then tell us. If it keeps coming, ring someone. A prompt out of nowhere is a fire alarm, not a nuisance.

What good looks like six months on

You want three numbers: the share of staff using a phishing-resistant method, the number of people still on SMS only (aim for zero in admin and finance), and the time between someone spotting a rogue prompt and telling you. That last one is the real measure of whether any of this has landed.