# What is Multi-Factor Authentication Takeover?
Source: https://arsen.co/en/resources/mfa-takeover
Summary: MFA Takeover covers MFA fatigue and interception. Fraud actors overwhelm or bypass multi-factor authentication to access accounts.

**Multi-Factor Authentication Takeover appears under Initial Access in the [MITRE F3 Framework](https://ctid.mitre.org/fraud). It describes two distinct approaches fraud actors use to defeat MFA; neither of which requires knowing the victim's actual password.**

## Sub-techniques

| Sub-technique | Method | Target psychology |
|---|---|---|
| MFA Request Generation (MFA Fatigue) | Bombarding the victim with repeated push notifications until they approve | Frustration, confusion, desire for the notifications to stop |
| MFA Interception | Capturing OTPs, push approvals, or hardware token codes in transit | No psychological component, pure technical interception |

## How does MFA fatigue work?

The attacker already has the victim's password (typically from [phishing](https://arsen.co/en/resources/phishing) or a data breach). They repeatedly trigger the MFA prompt (sometimes dozens of times) until the victim approves by mistake, out of frustration, or because they assume it is a technical glitch.

Social engineering is sometimes layered on top: the attacker calls the victim (a [vishing](https://arsen.co/en/resources/vishing) call) posing as IT support, claiming to be sending a verification request and asking the victim to "confirm" it.

## How does MFA interception work?

Interception methods include:

- SMS OTP capture via SS7 vulnerabilities or SIM swapping
- Push notification relay via [Adversary-in-the-Middle](https://arsen.co/en/resources/adversary-in-the-middle) proxies
- Hardware token cloning
- Exploitation of backup recovery codes obtained through phishing

## Key takeaways

- MFA Takeover covers two sub-techniques in MITRE F3: fatigue (bombardment) and interception.
- MFA fatigue exploits user frustration, no technical bypass required.
- Vishing is frequently combined with MFA fatigue to add a social engineering layer.
- Phishing-resistant MFA (FIDO2, passkeys) is the primary technical countermeasure to both sub-techniques.
- Employees need specific training to recognise MFA fatigue attacks and never approve unexpected prompts.
	

## What is MITRE Fight Fraud Framework™ (F3)?

The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope. 

[Explore the F3 Matrix](https://ctid.mitre.org/fraud)