Twenty Approvals Before Lunch: What Repeated Sign-In Nudges Really Mean

It's 9:12 on a Tuesday. Your receptionist's phone buzzes: Approve sign-in? She's nowhere near a computer, so she taps Deny and carries on. Four minutes later it buzzes again. Then again. By the fifth one she's trying to serve a customer, the phone won't stop, and she taps Approve just to make it go away. That tap is the entire attack.

Push bombing, and why it works

Most of us think of a hack as something dramatic — a hooded figure, a wall of green text. In reality, the most common path into a small business mailbox is much duller. Someone's email and password turn up in a breach dump, or get captured by a fake login page, or get scooped up by malware on a home laptop. The password works. The only thing standing between the attacker and the inbox is the second factor — and the second factor is a human being who is busy, polite and slightly worried about being rude.

So the attacker simply asks. Repeatedly. This is "MFA fatigue", sometimes called push bombing, and it exploits a very reasonable instinct: if something keeps asking for permission, surely it's meant to be there.

Worth remembering that Microsoft made number matching the default in Authenticator back in 2023, and Google prompts show a matching number too. That helps a lot — but only if the person reads the number instead of thumbing the big blue button.

Why one careless tap is worse than a lost password

If an attacker gets your password alone, you change it and you're done. If they get an approved sign-in, they walk away with a session token — and tokens don't care about your password. They can register their own authenticator app as a second method, so future prompts go to their phone. They can add an inbox rule that quietly files your supplier replies into a folder nobody opens. They can consent to a third-party app that reads your mail. At that point, resetting the password on its own changes very little.

That's the reason the response plan below is about sessions and methods, not just credentials.

The rule your team needs to remember

One sentence, and it should go in the staff handbook and the team chat: if you didn't just type your password into something, deny it and tell us.

Add a second sentence for the phone calls: if someone rings claiming to be from IT and asks you to read out a code or approve a prompt, hang up and ring the number you already have. Genuine support doesn't mind being called back.

The first hour: a practical response plan

1. Talk to the person before you touch anything. How many prompts, roughly when, were they on a work laptop or their own phone, did anything else odd happen? Two minutes of context saves an hour of guessing.

2. Look at the sign-in logs. In Microsoft 365, the Entra admin centre shows sign-in activity with location, IP and failure reason. On Google Workspace, it's the Admin console under Reporting, then the login audit log. You're looking for a burst of failures from somewhere unexpected, followed by a success — and for the phrase about authentication being satisfied by a token already in hand, which is the tell-tale sign of a replayed session.

3. Check which methods are registered. Anything you don't recognise — an unfamiliar authenticator, an old mobile number, a personal email as a recovery address — comes off. While you're there, confirm the owner or finance director doesn't have a lone SMS number as their only factor.

4. Empty out the sneaky stuff. Inbox rules that forward or delete, mailbox delegation, auto-replies with odd content, and third-party app permissions granting mail access. These are the quiet bits attackers leave behind.

5. Revoke sessions, then reset. Sign the account out everywhere, then set a new password, then have the person re-enrol their authenticator with number matching while you're on the phone with them. Doing it in that order avoids the classic mess of resetting a password that an existing session simply ignores.

6. Reconnect their devices calmly. Rather than letting them loose, sit with them for ten minutes and sign in on the laptop, the phone and any shared tablet in turn. It's quicker than three days of "my email's broken" tickets.

Tighten the settings afterwards

For Microsoft 365, turn on number matching and additional context in the authentication methods settings, and switch on security defaults if you're on a basic plan. Block the old-style authentication protocols nobody uses anymore — they're a well-worn way around MFA. If you're on Business Premium, a simple conditional access policy that requires a compliant or known device for email is money well spent.

On Google, enforce two-step verification for everyone, prefer security keys or passkeys for whoever holds the bank details, and review the list of connected apps every few months.

And change the passwords that matter — email, finance, your domain registrar — to something long and unique, stored in a password manager rather than on a sticky note under the keyboard.

Don't make an example of anyone

The person who tapped Approve is now your best source of information and your most anxious member of staff. If the reaction is a telling-off, the next person will stay quiet, and you'll find out about the compromise three weeks later when an invoice gets redirected. Make reporting quick, boring and blameless.

A prompt you didn't request is not an annoyance to be swatted away. It's a knock at the door, and somebody is testing whether anyone's in.