Push fatigue and backup codes are practical weak points of two factor authentication when people approve prompts blindly or store codes carelessly.
The second factor itself is explained on the companion page, and nothing here is a method for defeating it.
How it works
Push fatigue happens when repeated approval prompts annoy someone into accepting a sign in they did not start.
The attacker relies on impatience, not on breaking the cryptography of the factor.
Backup codes are static recovery secrets that behave like another password when they sit in mail or a shared file.
Number matching and a calm recovery process reduce both fatigue and careless storage.
Concrete examples
- An employee approves a late prompt for a sign in they did not begin.
- Backup codes sit in a mailbox that an attacker can already read.
- A help desk resets a factor after the caller quotes only a public employee number.
Protective measures
- Require number matching so the person must see the same number on both screens.
- Limit how often approval prompts can be sent to one account.
- Store backup codes offline and treat them with the same care as a password.
- Verify identity on a channel you already trust before anyone resets a factor.
Related articles
What is two factor authentication? explains the second proof itself, separate from fatigue and recovery codes.
What is vishing? shows the phone pressure that tries to make someone read a code aloud.
What is user awareness training? teaches people to refuse unexpected prompts and to protect recovery secrets.