Telecom
What You Need to Know About Multifactor Authentication Fatigue Attacks and How they can be Prevented
Multifactor authentication is a security measure that requires users to provide a second form of verification before they can log into a corporate network. It has long been considered essential for keeping fraudsters out. However, cybercriminals have been discovering increasingly clever ways to bypass it.
During an attack on Uber’s IT systems in 2022, the hackers did not use any sophisticated tactics to gain access. Instead, they bombarded an employee with repeated login requests until, out of sheer frustration, the employee approved one.
This type of cyberattack is known as an “MFA fatigue attack” and poses a real risk to organisations, says Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 AFRICA, a cybersecurity training designer.
“MFA fatigue attacks, also known as prompt spamming or authentication bombing, exploit human vulnerability, rather than relying on high-tech hacking methods,” she explains. “These attacks involve sending continuous push notifications to a target who has already provided their username and password, aiming to irritate or confuse them into unwittingly granting the attacker access to their account or system.”
With Uber, the attacker likely bought the contractor’s Uber corporate username and password on the dark web. The attacker then made repeated attempts to log into the victim’s Uber account. Each time, the victim received a request to approve a two-factor login, which blocked access at first. However, eventually, and after the attacker contacted the contractor on WhatsApp claiming they were from Uber IT and that the only way to get rid of the never ending notifications was to accept one, the contractor accepted one request, allowing the attacker to successfully log in.
Previously, cybersecurity experts believed that Multifactor Authentication (MFA) was a foolproof method to protect corporate IT systems from hackers. “Now we’re seeing attackers finding ways around it by bombarding the victim with scores of MFA requests or by tricking them over the phone,” says Collard. This tactic, similar to a swarm of bees overwhelming someone, is a simple yet effective social engineering technique used by hackers. “By bugging you repeatedly until you give in, malicious actors can manipulate users into approving fraudulent access attempts,” says Collard.
How can you prevent it?
The best way to prevent MFA fatigue attacks in organisations is not to use push notifications. “While MFA provides an extra layer of security, it’s not foolproof,” she asserts. “From a cybersecurity perspective, I would recommend that organisations disable push notifications altogether and rather use alternative verification methods.”
An example of a better verification method is number matching. “This involves matching a unique code provided by the authentication app with the code displayed on the screen during the login process,” explains Collard.
A challenge-response method is another effective way of providing additional security. This method asks a user a specific question to verify their identity or to perform a task in response to a challenge. “A challenge-response method is more difficult for hackers to bypass. It can involve mechanisms like biometric authentication, in which users must scan their fingerprints or irises or use facial recognition to gain access to a network.” However, both of the above are not immune against so-called man in the middle or social engineering attacks tricking the users to hand over their OTP or response to the fraudster.
Another effective verification method is FIDO2, an open authentication standard that allows users to log in without using passwords. “You can implement FIDO2 using hardware security keys,” she explains. Typically, USB sticks store the user’s private key, while the public key is stored on the authentication server. As soon as the user enters their username and password, the system requests them to use the hardware key. “It is more resistant to phishing as it works on a challenge-response protocol and doesn’t rely on a one-time PIN that can be intercepted,” she adds.
Mindfulness is key
As with all hacking attempts, it’s crucial that users remain calm and mindful, rather than reacting emotionally. “Stay tuned into your body’s responses when dealing with potential cybersecurity threats, whether they are phishing emails or MFA fatigue attacks,” says Collard. “If something feels strange, like if the situation is putting you under undue pressure, listen to that cue and don’t respond in a knee-jerk fashion. In this way, you’ll keep a straight head and thwart potential data breaches.”
MTN Nigeria is set to reignite the dreams of creatives with the launch of its Best of the Streets talent competition for the 2025 edition. This initiative aims to discover and nurture Nigeria’s next generation of creative talent.
L-R: Mobolaji Ogunlende, Honourable Commissioner for Youth and Social Development, Lagos State; Dapo “D’Banj” Oyebanjo, Singer and Founder of C.R.E.A.M platform; Dandizzy, Rapper and Singer; A’isha Umar Mumuni, Chief Digital Officer, MTN Nigeria and Obi Asika, Nigerian music executive and Director-General, National Council for Arts and Culture, NCAC., at the Best of the Streets press briefing on Wednesday, April 23 held at the MTN Rooftop Events Centre, Ikoyi, Lagos.
Slated to commence on May 1, 2025, the competition offers unsigned artists a transformative platform to compete for life-changing rewards, including a grand money prize, professional music video production, and an EP recording deal.
At the press briefing on Wednesday April 23, A’isha Umar Mumuni, Chief Digital Officer of MTN Nigeria, emphasized the initiative’s impact.
“The premise of Best of the Streets is that there’s talent in every street in Nigeria, whether it’s acting, singing, dancing, comedy or other performance arts.
“Best of the Streets seeks to bring out that talent, to show Nigerian youths that there are opportunities everywhere; and at MTN, we are very proud to take part in creating these opportunities.”
Best of the Streets is in collaboration with C.R.E.A.M (Creative Reality Entertainment Art and Music), founded by Nigerian rapper, Dapo “D’Banj” Oyebanjo is a platform which provides talent management, publishing, and funding support to grassroots artists.
“The C.R.E.A.M platform provides solutions and services for talents, creatives and entrepreneurs, by granting them convenient access to showcase their skills and monetize their content. With our newly launched distribution arm, we are not just discovering talent, we are giving them the tools to take them global,” D’banj explained.
Chris Anokute, Nigerian-born LA-based American Executive, known for discovering global superstar Katy Perry, commended the efforts of this initiative in pushing local Nigerian music to the international stage. “Best of the Streets is the greatest artiste discovery platform I’ve seen come out of Africa.
“The music industry is, as of last year, a 30-billion-dollar industry. Afrobeats is the fastest growing genre in the entire world, over 1.1 million hours of music streamed out of Nigeria on Spotify this year alone.”
On the importance of empowering the creative capacities of the youth, Mobolaji Ogunlende, Honourable Commissioner for Youth and Social Development in Lagos State. “As a government, we have vowed not to leave anybody behind in Lagos state, irrespective of their background.
“There are about 30 million citizens in Lagos, and 60% of the youth. Not every youth will be able to go to school, but we still have the creatives, digital, fashion icons, among others. This platform is an avenue to encourage them.”
To participate, aspiring contestants can dial *463# on their MTN line, upload original content via the official @creamplatform, and mobilise votes from the public. Over 2584 creatives are set to be showcased and rewarded this year. Entries into this competition continue up until December, with daily, weekly and monthly winners, with a final winner who will secure the grand prize.
The Best of the Streets initiative reinforces MTN’s commitment to youth empowerment and creative innovation, aligning with Nigeria’s growing entertainment industry demands.
Meta has announced its intention to appeal the decision of the Competition and Consumer Protection Tribunal (CCPT), which upheld a $220 million fine imposed by the Federal Competition and Consumer Protection Commission (FCCPC) over its data practices.
The penalty follows a 38-month investigation conducted by the FCCPC, in collaboration with the Nigeria Data Protection Commission (NDPC), which ran from 2021 to December 2023.
The investigation found evidence of unauthorised data sharing, insufficient user consent mechanisms, and discriminatory practices that treated Nigerian consumers differently from those in other regions.
In July 2024, the FCCPC imposed the $220 million fine on Meta and WhatsApp, citing violations of Nigeria’s data protection and consumer rights laws. Additionally, the ruling mandated corrective actions to ensure that Meta’s business practices comply with Nigerian regulations.
In a decision delivered on Friday, April 25, the tribunal upheld the fine, reaffirming the FCCPC’s authority and investigative processes. The tribunal also ordered Meta to pay an additional $35,000 to cover the costs incurred during the investigation.
However, Meta expressed disagreement with the tribunal’s ruling, stating in a statement on Saturday, April 26, that it would urgently seek to appeal the decision and apply for a stay of execution.
“We are urgently applying to stay the order and appeal today’s decision to avoid any impact to users,” WhatsApp said.
The company also contested the tribunal’s findings, claiming that the ruling misrepresented how WhatsApp operates and contained inaccuracies regarding its data practices.
Competition and Consumer Protection Tribunal has upheld a $220 million fine imposed by the Federal Competition and Consumer Protection Commission (FCCPC) on Meta Platforms Inc. and WhatsApp LLC for data privacy violations in Nigeria.
The Tribunal also awarded $35,000 in investigative costs to the country’s Federal Competition and Consumer Protection Commission .
In a statement issued by the FCCPC, the Tribunal delivered its judgment in the appeal filed by Meta Platforms Incorporated (Facebook) and WhatsApp LLC against the Federal Competition and Consumer Protection Commission (FCCPC), affirming the Commission’s authority and ruling in favour of its actions on nearly all contested issues.
According to the statement by the FCCPC, “The Tribunal specifically determined that the Commission adhered to prevailing laws, fulfilled its mandate, and exercised its powers by the 1999 Constitution (as amended).
“It ruled that the multiple actions by WhatsApp and Meta, for which the Commission made findings of violations, were correctly identified, and that the Commission did not err in making those findings.”
The statement revealed that WhatsApp and Meta’s legal team was led by Professor Gbolahan Elias (SAN), while the FCCPC was represented by Babatunde Irukera.
It added that both legal teams presented their final arguments on behalf of their respective clients on January 28, 2025.
“The FCCPC had on July on July 19, 2024, issued a Final Order imposing a $220 million administrative penalty after concluding that the companies engaged in discriminatory and exploitative practices against Nigerian consumers, the investigation started in 2020.
“The case arose from a 38-month joint investigation initiated by the FCCPC and the Nigeria Data Protection Commission (NDPC) into the conduct, privacy practices, and consumer data policies of Meta Platforms and WhatsApp.
“Dissatisfied with the Order last year, Meta and WhatsApp appealed to the Tribunal, challenging both the legal basis and the findings of the Commission,” FCCPC said.
The Tribunal upheld the FCCPC’s authority and investigative procedures in Meta and WhatsApp’s appeal, resolving most of the contested issues in the Commission’s favour.
It confirmed that the FCCPC acted within its constitutional and statutory mandate, particularly regarding fair hearing, data protection, and consumer rights.
While it dismissed the majority of the appellants’ objections, it set aside one specific order (Order 7) for lacking sufficient legal basis.
While expressing satisfaction with the judgment, Tunji Bello, executive vice chairman/CEO, commended the Commission’s legal team for their exceptional diligence and forensic expertise in assembling evidence and presenting their case.
He reaffirmed the FCCPC’s unwavering commitment not only to protecting the rights of Nigerian consumers but also to promoting fair business practices in line with the FCCPA (2018) and the Renewed Hope Agenda of the Nigerian government.
AFC Appoints Ireti Samuel-Ogbu as Chair of Board of Directors
FG to Sanction Airports Without Permits from January 2026
CBN Urges Banks to Source FX for PAPSS Settlement Through NFEM
FIRS Orders Banks to Close Unauthorised Tax Collection Accounts
NBC Loses Appeal as Tribunal Upholds ₦190m Fine for Misleading Packaging
Telecom1 day agoMeta Challenges Nigerian Tribunal’s $220M Fine over Data Breaches
Broadcasting1 day agoAI and Cybersecurity: Balancing Innovation with Caution
E-Financial1 day agoSupreme Court Sets Aside N22 Trillion Judgement against Union Bank
E-Business1 day agoFG Warns Nigerians Against Growing Threat of Cyber Slavery in West Africa
News1 day agoEFCC Bans Cash above $10,000 from Leaving Nigeria without Declaration
E-Financial1 day agoUBA Envisions Footprint in over 100 Countries
E-Business1 day agoNCC Vows to Tackle Online Infringement, Block Illegal Music Websites
General News1 day agoAfe Babalola University Partners with New Horizons to Integrate 4IR Skills into Academic Curriculum