Updated in July 2026
- 70% of confirmed account takeovers have been attributed to push prompts or SIM swaps in some industry incident surveys
- However, this figure reflects the distribution of observed ATO cases across organizations and should be interpreted separately from per-campaign success probabilities. Per-attempt success rates (see table) measure likelihood on each targeted campaign. The 70% figure shows these two vectors account for a large share of observed compromises across environments. Technical leaders must weigh attacker success rates, detection gaps and operational costs. They must choose between low-friction MFA and stronger, higher-effort controls.
- Quantified trade-offs and immediate hardening steps matter for pre-migration decisions, post-incident containment, and procurement
MFA Bypass Risks: Push Fatigue vs OTP SIM Swap quantifies attacker success likelihood, mitigation cost and ROI. It presents a numeric risk matrix, SIEM detection indicators, and IdP configuration steps for Azure AD, Okta, Ping, and Auth0. It also gives prioritized Zero Trust controls so teams can pick concrete defenses and incident playbooks.
Quick comparison
This section gives a concise numeric view to pick a short and long term defense path. Read the table, then follow the prioritized steps below.
Metrics explained
The table scores each vector on attacker success probability, typical impact, detectability, mitigation cost, and remediation time. These metrics reflect enterprise experience across cloud IdPs and mobile carriers.
Scoring rubric
Scores use a 1–5 scale where 5 is highest risk or cost. Use the rubric to compute risk score = probability × impact × (1/detectability). Adjust weight for business context.
| Attack vector |
Success probability (per campaign) |
Typical impact (USD) |
Detectability |
Mitigation cost (per user) |
Time to remediate |
| Push notification fatigue |
0.1%–1% per targeted campaign |
$1k–$250k (credential theft, fraud) |
High if instrumented, minutes–hours |
Low (TOTP apps free; push rate limits negligible) |
Minutes–hours with good telemetry |
| SMS OTP via SIM swap |
0.01%–0.1% per targeted attempt |
$10k–$5M (high‑value ATOs) |
Medium if telco signals ingested, hours–days |
Medium (carrier coordination, port freeze programs $1–$10/user) |
Hours–days; forensic trace often needed |
| Authenticator apps (TOTP) |
0.01%–0.2% |
$1k–$50k |
High when logs capture factor checks |
Very low (free apps) |
Minutes–hours |
| FIDO2 / passkeys (phishing‑resistant) |
~0% for remote phishing |
Negligible residual ATO risk |
Very high detectability, cryptographic evidence |
$35–$75 per hardware key (one‑time) |
Minutes to enforce; days to fully enroll users |
NIST digital identity guidance identifies SMS as a restricted authenticator and advises organizations to assess its risks carefully for high-value transactions. See the guideline for verifier and authenticator requirements:
NIST SP 800‑63B.
Focus on telemetry and early detections right away.
Push notification fatigue
Push prompt abuse targets human decision points and IdP misconfigurations. Attackers send repeated approvals or socially condition users to accept prompts. Detection relies on granular push telemetry and rate throttles.
Pros
Push reduces friction for users and integrates with device posture checks. It scales well for broad user bases and supports device context and signal enrichment.
Cons
The most frequent error at this point is treating push as phishing‑resistant by default. Without rate limits or escalation policies, push is phishable through fatigue and social engineering.
For whom
Choose push when user experience is critical and device management enforces attestation and enrollment. Use push with additional controls for mid‑risk user groups.
Not for whom
Avoid push as sole MFA for high‑value accounts or admin roles where account compromise causes material loss. In those cases require phishing‑resistant authenticators.
Choose this if: Your user base needs low friction. You can apply telemetry, rate limits and conditional access within 90 days.
Start with high‑risk roles and expand from there.
SMS OTP and SIM swap
SMS OTP fails when an attacker gets control of the subscriber number. SIM swap uses carrier porting or insider fraud to receive OTPs. This enables account takeover with password resets. Telemetry for port‑out events changes timelines and response actions.
Pros
SMS is ubiquitous and easy to deploy. It remains usable where device management or hardware keys are infeasible due to legacy constraints.
Cons
This works well in theory, but in practice SIM swap yields high‑impact compromises with complex remediation. SMS does not bind the authenticator to the client or origin.
For whom
Retain SMS only for low‑risk, low‑value accounts where no better alternative exists and compensating controls are enforced.
Not for whom
Do not use SMS OTP for privileged access, financial transactions, or accounts subject to regulatory scrutiny under NIST, NYDFS, or EO14028.
Choose this if: Legacy constraints prevent moving away from SMS and immediate replacement is not viable. Pair with carrier protections and adaptive policies.
Measure results and adjust thresholds every two weeks.
How to choose by situation
Decision requires balancing probability, impact, detectability, and cost. Use short experiments to validate assumptions against live telemetry before major procurement.
Risk thresholds
Set a risk threshold for mandatory phishing‑resistant factors. For example, require FIDO2 for any role with potential loss above $50k or access to sensitive customer data.
Operational steps
- Inventory users and map high‑risk roles.
- Apply conditional access to force stronger factors for those roles.
- Measure push/OTP event rates for two weeks and compute detection lead time.
Estimated costs: a basic hardware FIDO2 key typically starts at $35–$45 retail (2024), while managed passkey services carry per‑user SaaS fees from $2–$10/month depending on vendor and scale.
IdP hardening and detection playbook
Hardening IdPs reduces bypass exposure quickly when combined with detection. The checklist below gives vendor steps to deploy in the first 30 days and follow‑ups for 90 days.
Azure AD quick actions
- Require passwordless or FIDO2 for privileged roles via Conditional Access
- Disable SMS as default MFA in Authentication Methods policy
- Enable sign‑in risk policies and require reauthentication for risky sign‑ins
- Log and export SignInLogs with authenticationDetails for SIEM correlation
Okta, Ping, Auth0 actions
Create sign‑on policies that escalate to WebAuthn when risk score exceeds threshold. Disable SMS in factor enrollment defaults. Configure factor enrollment restrictions and record all factor changes in audit logs.
For carrier signal ingestion and tactical guidance, see CISA's MFA resources:
CISA MFA guidance.
Relative risk and detectability
Push fatigue (probability)
The graphic visualizes relative attributes; use SIEM measurements to calibrate percentages for your environment. In the image below, the difference in detectability is clear.
SOC teams need concrete detection playbooks that turn the high‑level advice into repeatable actions. For push notification fatigue, include SIEM detections such as UBA rules for excessive prompts.
- UBA rule: more than N push prompts to one account within M minutes
- Pattern: an approve follows three or more denies within ten minutes
- Geo-velocity anomaly: attestation unchanged while sign-in IP jumps between distant regions
For SIM swap and SMS OTP detection, ingest carrier port‑out hooks and create alerts. Alert on port‑out request events and sudden MFA method changes. Also alert on large bursts of MFA failures followed by a success from a new number.
Provide example Elasticsearch and Splunk pseudo‑queries and threshold values so teams can tune false positives against a 14‑day baseline and iterate. These detections bridge SIEM detection with operational triage. They support ticketing, automated step-up, and temporary MFA blocks. This accelerates SOC/IR response to MFA bypass attempts.
Expand the IdP hardening section with step-by-step configuration examples so engineers can act immediately. For Azure AD security, navigate to Authentication methods and set policies. Disable Microsoft Authenticator push for high-risk users. Set "Require attested hardware" for passwordless flows. Create a Conditional Access policy for privileged roles. Grant controls: require multifactor and set authentication strength to FIDO2. Set session controls to require reauthentication for sensitive apps.
For Okta security, create sign-on rules for admin groups. Set actions to prompt for factor and disable SMS in enrollment defaults. Require WebAuthn for admin roles and record audit event IDs. For Ping and Auth0, provide equivalent menu paths and sample API JSON. Use APIs to enforce WebAuthn and block SMS enrollment programmatically. Include these menu locations, policy names, and example API calls to reduce ambiguity.
Before the FAQ, provide the SOC team with the SIEM queries and sample IdP sign‑in logs. Use them to validate detection latency and false positive rates over a 14‑day window. This step reduces uncertainty and identifies the highest ROI controls.
What nobody tells you
Telco processes and internal IdP defaults create gaps that controls alone cannot close. The unseen costs come from slow forensic evidence, legal holds, and user churn after ATOs.
Hidden costs
Carrier investigations often require legal paperwork and can take days to resolve. The IBM Cost of a Data Breach Report 2023 shows breach response costs remain high, with U.S. averages at $9.44M. This magnifies the ROI of preventive controls.
Edge cases
A common case: an executive reports a lost phone, requests SMS fallback, then a port‑out occurs within 24 hours. Rapid account takeover follows. This sequence bypasses many alert thresholds unless recovery and fallback are tightly controlled.
Exceptions apply when every user already uses phishing‑resistant authenticators exclusively, or when regulation forces legacy MFA methods; in those cases prioritize monitoring, network segmentation and rapid token revocation over replacing MFA methods.
Frequently asked questions
What is push notification fatigue?
Push notification fatigue is an attack that sends repeated approval prompts until a user approves. It exploits human behavior and weak IdP rate limits. SOC detection should look for repeated push events, rapid denies followed by an approve, and abnormal IP patterns.
How does a SIM swap attack work?
SIM swap is a process where an attacker convinces a carrier to port a number to a device they control. The attacker then receives SMS OTPs and bypasses SMS‑based MFA. Watch for port‑out requests and sudden MFA method changes as early indicators.
Can push notifications be bypassed?
Yes, push notifications can be bypassed through fatigue, device compromise, or stolen session tokens. Enforce rate limits, require reauthentication for critical actions, and escalate to phishing‑resistant factors for high‑risk roles.
How to prevent SIM swap and push fatigue now?
Remove SMS as default for privileged users. Enable FIDO2 where possible. Apply push rate limits and coordinate with carriers on port‑freeze programs. Use adaptive access for anomalous sign‑ins and instrument telemetry for fast detection.
Is SMS‑based OTP acceptable for compliance?
SMS is acceptable only as a low‑risk fallback in some contexts. NIST SP 800‑63B (2017) advises against SMS for high‑value authentication. Regulators will expect stronger controls for critical systems and data.
What are phishing‑resistant authenticators?
Phishing‑resistant authenticators use public key cryptography and are bound to origin, preventing credential relay. FIDO2 and WebAuthn meet these criteria and provide strong defenses against push and SMS bypass techniques.
How does zero trust reduce MFA bypass risk?
Zero Trust reduces blast radius by enforcing continuous verification, least privilege and risk‑based access. Aligning IdP policies with Zero Trust limits what a successful bypass can access and shortens remediation windows.
Prioritize quick wins that reduce exposure within weeks.
Final verdict and prioritized recommendation
The highest impact move for most organizations is to require phishing‑resistant authenticators for privileged and high‑value accounts. Retain TOTP for general users during a phased rollout.
For constrained budgets deploy adaptive controls and carrier protections first. Then migrate to FIDO2 within 12–18 months.
The evidence points to this staged path. Short‑term controls cut exposure quickly. Long‑term replacement of SMS and push with FIDO2 delivers the largest reduction in residual risk.
Track measurable signals: detection lead time, successful ATO count, and enrollment rates to validate ROI.
Resources cited: NIST SP 800‑63B (2017) NIST, Executive Order 14028 (2021) EO 14028, CISA MFA guidance CISA.
