====== 🔐 Duo Fraudulent Authentication Requests (Push Fatigue Protection) ======

<WRAP info>
**Purpose:**  
To explain what a fraudulent Duo authentication request is, how push fatigue attacks work, and the correct best-practice user behaviour when using Duo MFA.
</WRAP>

===== 📌 Platform =====

  * MFA Provider: [[https://duo.com|Duo Security]]
  * Authentication Method: Push Notification (Duo Mobile App)

----

===== 🚨 What Is a Fraudulent Duo Request? =====

A fraudulent authentication request occurs when a user receives a Duo push notification **without actively attempting to log in**.

This usually means:

  * The attacker already has the user's username and password.
  * They are attempting to bypass MFA.
  * They are hoping the user will approve the push notification.

This method is commonly known as:

<WRAP danger>
**Push Fatigue Attack**  
Attackers repeatedly send push notifications hoping the user will press *Approve* out of confusion, habit, or frustration.
</WRAP>

----

===== 🛡️ Best Practice – Correct User Behaviour =====

==== ✅ 1. Open Duo BEFORE Logging In ====

Users should:

  - Open the **Duo Mobile app** on their device.
  - Then initiate the system login.
  - Immediately approve the push while actively viewing the request.

<WRAP tip>
Opening the Duo app before logging in ensures:
  * The push is expected.
  * The approval is intentional.
  * No delayed or mistaken approvals occur.
</WRAP>

----

==== ✅ 2. Only Approve When Actively Logging In ====

If you are not logging into a system:

<WRAP danger>
**DO NOT APPROVE THE REQUEST**
</WRAP>

Unexpected push notification = 🚩 Security incident.

----

==== ❌ 3. Never “Wait for the Prompt” ====

Do NOT:

  * Click login and wait passively.
  * Approve a push that appears unexpectedly.
  * Approve repeated push notifications.
  * Assume “it’s probably fine.”

Multiple pushes in a short time = high likelihood of attack.

----

===== 🚑 If a Fraudulent Request Is Received =====

Users must:

  - Press **Deny**
  - Immediately report to IT
  - Change password if instructed

<WRAP important>
Treat every unexpected Duo push as a potential account compromise.
</WRAP>

----

===== 🔎 Why This Is Critical =====

MFA only protects the organisation if:

  * Approvals are intentional.
  * Users remain alert.
  * Push notifications are treated as security events.

<WRAP danger>
One accidental approval can result in full account compromise.
</WRAP>

----

===== 📢 End-User Awareness Message (Short Version) =====

<WRAP box>
If you are not logging in and receive a Duo push:

  * Press **Deny**
  * Report it immediately
  * Do NOT approve it

Always open the Duo app before logging in.
</WRAP>

----

===== 📊 Risk Level =====

^ Threat Type ^ Impact ^ Likelihood ^ Risk Level ^
| Push Fatigue / MFA Bypass | High | Increasing Globally | 🔴 High |

----

===== 📅 Review Cycle =====

  * Review annually
  * Review after any reported MFA incident

===== Quick Links =====
  * Support Email: [[mailto:help@mmc24.com|help@mmc24.com]]
  * Self-Serve Tickets: [[https://help.mmc24.com|help.mmc24.com]]



Author: Mike
Last Updated: %%DATE%%