This is an old revision of the document!
Table of Contents
🔐 Duo Fraudulent Authentication Requests (Push Fatigue Protection)
Purpose: To explain what a fraudulent Duo authentication request is, how push fatigue attacks work, and the correct best-practice user behaviour when using Duo MFA.
📌 Platform
- MFA Provider: Duo Security
- Authentication Method: Push Notification (Duo Mobile App)
🚨 What Is a Fraudulent Duo Request?
A fraudulent authentication request occurs when a user receives a Duo push notification without actively attempting to log in.
This usually means:
- The attacker already has the user's username and password.
- They are attempting to bypass MFA.
- They are hoping the user will approve the push notification.
This method is commonly known as:
Push Fatigue Attack Attackers repeatedly send push notifications hoping the user will press *Approve* out of confusion, habit, or frustration.
🛡️ Best Practice – Correct User Behaviour
✅ 1. Open Duo BEFORE Logging In
Users should:
- Open the Duo Mobile app on their device.
- Then initiate the system login.
- Immediately approve the push while actively viewing the request.
Opening the Duo app before logging in ensures:
- The push is expected.
- The approval is intentional.
- No delayed or mistaken approvals occur.
✅ 2. Only Approve When Actively Logging In
If you are not logging into a system:
DO NOT APPROVE THE REQUEST
Unexpected push notification = 🚩 Security incident.
❌ 3. Never “Wait for the Prompt”
Do NOT:
- Click login and wait passively.
- Approve a push that appears unexpectedly.
- Approve repeated push notifications.
- Assume “it’s probably fine.”
Multiple pushes in a short time = high likelihood of attack.
🚑 If a Fraudulent Request Is Received
Users must:
- Press Deny
- Immediately report to IT
- Change password if instructed
Treat every unexpected Duo push as a potential account compromise.
🔎 Why This Is Critical
MFA only protects the organisation if:
- Approvals are intentional.
- Users remain alert.
- Push notifications are treated as security events.
One accidental approval can result in full account compromise.
📢 End-User Awareness Message (Short Version)
If you are not logging in and receive a Duo push:
- Press Deny
- Report it immediately
- Do NOT approve it
Always open the Duo app before logging in.
📊 Risk Level
| Threat Type | Impact | Likelihood | Risk Level |
|---|---|---|---|
| Push Fatigue / MFA Bypass | High | Increasing Globally | 🔴 High |
📅 Review Cycle
- Review annually
- Review after any reported MFA incident
Author: IT Infrastructure Last Updated: DATE