Don’t Get Caught in an MFA Bombing Scam

Don’t Get Caught in an MFA Bombing Scam

Multi-Factor Authentication (MFA) is one of the best ways to protect your accounts. It adds an extra step like entering a code sent to your phone after your password to make sure it’s really you logging in. But fraudsters are always looking for ways to get around security and scammers have found a way to turn this safety feature against you. A new tactic is on the rise called MFA Bombing (also known as MFA Fatigue or MFA Spamming) and here’s how it works:

1. A scammer gets your login info—maybe from a phishing email, malware, or information found on the dark web.
2. They try to log in.
3. You get a flood of MFA requests through text, email, or an authentication app.
4. They hope you’ll eventually hit “approve” to make the pop-ups stop.

And if you do, they’re in.

Why It Works for Scammers

Scammers rely on their targets being busy or distracted, or even thinking that there could just be a glitch. After enough notifications, it’s tempting to just clear them all out, especially if you don’t know what’s going on. The goal is to tire their target out and have them confirm their identity via MFA notification.

How to Protect Yourself

• Only approve MFA requests you have initiated. If you weren’t logging in, deny the request.
• Change your password right away if you get multiple requests you didn’t trigger.
• Use an authenticator app instead of text messages if possible. It’s harder for scammers to exploit.
• Let us know immediately if this happens to you. The sooner you report it, the faster we can help lock things down. Connect with us at your nearest branch, by phone, or by chatting with a Live Agent online.

The Bottom Line

MFA is still one of the best ways to protect your accounts, as long as you’re the one who started the login. If something feels suspicious, trust your gut and don’t approve it.

If you think your Sound account has been targeted, chat with us right away or stop by your closest branch. We’ll help secure your account and stop the fraud before it can cause damage.