High riskSocial Media

MFA Fatigue Scam

In this scam, an attacker who has your password repeatedly triggers multi-factor approval prompts or codes, hoping you approve one out of annoyance or confusion, granting them access to your account.

Quick verdict

Risk level
High risk
Scam type
Account takeover (push bombing)
Main red flag
Repeated, unexpected login approval prompts or verification codes you did not request.
What to do first
Deny all prompts, do not approve, and change your password immediately.

What to know first

In this scam, an attacker who has your password repeatedly triggers multi-factor approval prompts or codes, hoping you approve one out of annoyance or confusion, granting them access to your account.

Social media scams spread through direct messages, ads, hacked friends' accounts, and fake profiles. They range from account-takeover phishing and fake giveaways to investment and romance fraud, exploiting the trust and reach of your own network.

The core pattern to watch for is clear: Repeated, unexpected login approval prompts or verification codes you did not request. Deny all prompts, do not approve, and change your password immediately.

Related tricks worth knowing: the Two-Factor Code Text Scam and the Account Ransom Scam. For the wider picture, browse the Social Media Scams guides or run the message through our scam checker.

Scam statistics

$1.4B
reported lost to fraud that began on social media in the US in 2023
Source: US Federal Trade Commission
Top channel
social media was among the most common ways scams reached people in 2023
Source: US Federal Trade Commission

Tell-tale red flags

  • Repeated approval prompts or codes you did not trigger
  • A message urging you to approve to 'stop the prompts'
  • A call or text claiming to be support asking you to approve
  • Prompts at odd hours
  • Pressure and confusion

Staying safe

  • Deny all approval prompts you did not initiate
  • Change your password immediately from a trusted device
  • Switch to phishing-resistant MFA or number matching where available
  • Report the attempts to the service and your IT team

How it usually reads

Example pattern, not a real report
Example pattern: Your phone gets a stream of 'Approve sign-in?' prompts or codes you did not request, sometimes with a message urging you to 'just approve it'.

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

What to notice: Repeated, unexpected login approval prompts or verification codes you did not request.

Steps if you already acted

  • If you approved a prompt, change your password and sign out all sessions immediately
  • Re-enable and review MFA settings and devices
  • Check the account for unauthorised changes
  • Report the takeover to the service

Common mistakes

  • Do not approve prompts to make them stop
  • Do not approve at a caller's request
  • Do not ignore repeated unexpected prompts

Scams like this one

High risk Text Message

Two-Factor Code Text Scam

In this scam a fraudster triggers a genuine two-factor or one-time code to your phone, then poses as support staff or a contact to pressure you into reading it back so they can take over your account.

Created by Scam or Safe Editorial Team
High risk Social Media

Account Ransom Scam

In this scam, an attacker takes over your social media account, locks you out by changing the details, and demands payment, often in crypto or gift cards, to return access, which they rarely honour.

Created by Scam or Safe Editorial Team
High risk Social Media

Instagram Verification Scam

This scam offers a blue verification badge or warns your account is at risk, then links to a fake login page that steals your password.

Created by Scam or Safe Editorial Team

Your questions answered

Why am I getting these prompts?
An attacker likely has your password and is spamming approval requests, hoping you approve one. Deny them all and change your password immediately.
Support told me to approve to stop them. Should I?
No. Genuine support never asks you to approve a sign-in prompt. Approving grants the attacker access. Deny and report it.
I approved one. What now?
Change your password and sign out all sessions immediately, review MFA settings and devices, check for changes, and report the takeover.
How do I prevent this?
Use phishing-resistant MFA or number-matching, keep passwords unique and strong, and never approve prompts you did not start.

Last reviewed June 2026 · Written & reviewed by the

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.