Fake Two-Factor Authentication Scams

Fake two-factor authentication (2FA) scams are attacks specifically designed to defeat the second layer of security you have added to your accounts. Two-factor authentication was introduced precisely to protect accounts even when a password is stolen — these scams are the response to that protection.

There are several distinct methods. In MFA fatigue attacks (also called prompt bombing), an attacker who already has your password spams your phone with push-approval notifications, hoping you will tap 'Approve' to stop the interruption. In real-time phishing relay attacks, a fake login page captures your password and one-time code as you enter them, passing them to the attacker simultaneously. In social engineering attacks, someone impersonating IT support or your bank calls and asks you to approve a prompt or share a code, claiming it is part of a verification or investigation process.

All of these attacks share a common feature: the attacker already has your password. The 2FA factor is the only thing standing between them and your account. Understanding this helps clarify the response — if you receive unexpected 2FA prompts, someone else has your password and is actively attempting to get in.

MFA fatigue works by volume and persistence. The attacker triggers authentication requests repeatedly — sometimes dozens of times — until the account holder approves one to end the interruptions. Some attackers follow up with a phone call claiming to be support, saying there is a login issue being investigated, and that the person needs to 'just approve one more prompt to confirm their identity'. This social engineering component transforms an inconvenience into a plausible-seeming request.

Real-time phishing relay is technically more sophisticated. The attacker sets up a proxy site that sits between you and the real service. When you enter your credentials on the fake page, the proxy logs them and passes them to the real site in real time. The real site then sends you a one-time code, which the fake page also captures — completing the login with full second-factor bypass before the code expires.

Code-phishing via phone combines social engineering with the fact that you have already received a real code. The caller fabricates a pretext — a security test, a fraud investigation, a system error — and asks you to read out the code that just arrived. The code was triggered by the attacker attempting a login. Reading it out completes their authentication.

Even push notifications can be targeted more precisely. In some advanced attacks, the approval prompt includes location data or a login description, and the caller pre-empts questions by naming the correct location as part of their cover story.

MFA fatigue exploits the fact that authentication prompts arrive on your phone as interruptions to whatever else you are doing. After the tenth notification in a row, the emotional state shifts from 'what is this?' to 'how do I make it stop?'. Approval is the path of least resistance.

When a phone call accompanies the prompt flood with a plausible explanation, the cognitive load is reduced further. You have been given a reason for the prompts and a socially credible way to respond.

Real-time relay attacks succeed because even security-conscious users may not realise that entering a code on what looks like a legitimate page can be exploited if the page is a proxy. The one-time code's entire defence rests on it being entered on the genuine site — a relay defeats this by acting as the genuine site.

An employee working from home receives a stream of push-approval notifications from their workplace authentication app. After the sixth prompt in five minutes, they receive a phone call from someone claiming to be from IT security. The caller says there is a system error triggering false prompts and asks the employee to approve one final prompt to 'clear the queue'. The employee approves it. The caller thanks them and ends the call. The prompt the employee approved was the attacker's own login attempt — they now have full access to the employee's workplace account.

This is IT support — we are testing your account security. Please approve the login prompt on your phone.

You will receive an authorisation request shortly. Please approve it to verify your identity for our fraud investigation.

We have detected suspicious activity. Can you please read out the 6-digit code that just arrived on your phone?

Your account is being secured. Approve the login notification on your authenticator app to confirm it is you.

This is the security team. There has been an authentication error. Please deny any prompts you receive and call us at [phone number].

One more prompt is coming to finalise the security review of your account. Please approve it when it arrives.

The rule for approval prompts is: never approve a login you did not initiate. If you receive a push notification for a login you are not performing, deny it. This is always the right action regardless of any calls, messages, or explanations you receive afterwards.

If you receive multiple unexpected prompts in a short period, your password has been compromised. Change it immediately on the real service (not via any link) and consider whether the account needs a full security review.

For code requests by phone, the same rule as password reset scams applies: never share a one-time code with anyone. It does not matter how credible the caller sounds or what reason they give.

For push-notification 2FA, consider enabling number matching (where you must enter a number displayed during login to approve) or using a hardware security key, both of which are resistant to these attacks.