MFA Fatigue

Imagine your phone keeps asking you to approve a sign-in, even though you are not trying to sign in anywhere. An attacker may be hoping you will approve one just to stop the requests. This is called MFA fatigue.

With number matching, the sign-in page shows a number that you must also enter or select in the approval request. An unexpected request cannot be approved just by choosing yes. To require number matching at Lumen, run:

seclab policy set number-matching on

You should see:

Policy updated: number-matching is on.

If Lee has already approved an attacker's request, turning on number matching will not sign the attacker out. Reset Lee's password to end that session too:

seclab reset lee

You should see:

Password reset for lee. Every session they had is signed out.

Only approve a request when you are signing in yourself. If unexpected requests arrive, deny them and report the problem. Turning MFA off would remove the protection.