11/09/2026
MFA is one of the best things you can turn on. But attackers have figured out a way around the simplest version of it.
It's called MFA fatigue. Someone who already has your password tries to log in over and over, and your phone keeps buzzing with "Approve sign-in?" At 11 p.m. or during a busy morning, people eventually tap Approve just to make it stop.
Two fixes:
1. Train your team: if you didn't just try to log in, never approve. Deny it and tell IT right away, because it means your password is already out there.
2. Turn on number matching. Instead of a simple Approve button, the user has to type a number shown on the login screen. CISA recommends it as a defense against exactly this attack.
Both Microsoft and Google offer stronger options. If you're not sure which one your business is using, that's a quick thing to check.
If you'd like a second set of eyes, book a Business Strategy & Risk Assessment at imperionllc.com/contact. It's a working conversation, not a sales pitch.