Short answer: Push notification 2FA sends an approval prompt to your phone instead of asking you to type a code. It is more convenient than TOTP and roughly as secure — provided it uses number matching. Without number matching, it is vulnerable to prompt bombing, where an attacker spams you with requests until you tap Approve out of exhaustion or confusion.
How push 2FA works
You enter your password. The service sends a notification to your registered phone. You open it, see the login attempt, and tap Approve or Deny. The app signs the approval cryptographically and the login proceeds.
The security model is sound: the private key lives on your device, the approval is signed, and nothing is transmitted that an eavesdropper could reuse. On paper this is stronger than a six-digit code you type into a browser, though it still falls short of genuinely phishing-resistant authentication.
The problem is not the cryptography. It is the tap.
Prompt bombing: the attack that works on tired people
An attacker who already has your password — from a breach, a phishing page, or credential stuffing — triggers login attempt after login attempt. Your phone buzzes. Once. Ten times. At two in the morning, fifty times.
Eventually one of three things happens. You tap Approve to make it stop. You tap Approve half-asleep without reading. Or the attacker calls you pretending to be IT support and says “we’re fixing a sync issue, please approve the prompt.”
This is not hypothetical. Prompt bombing has featured in several high-profile corporate breaches, and it works because it attacks attention rather than technology. It is one of the clearest illustrations of how 2FA can be bypassed in practice. A well-designed system will not let a single careless tap hand over an account.
Number matching is the fix
With number matching, the login screen displays a two-digit number. Your phone shows a keypad. You must read the number from the screen you are actually logging in on and type it into the app.
That small change breaks prompt bombing completely. An attacker triggering a login from their own machine sees a number you cannot see. You cannot approve by accident, because approving requires information only present on the real login screen.
Microsoft Authenticator enforces number matching for Entra ID sign-ins, and Duo, Okta and Google have equivalent mechanisms. If your organisation offers it, it should be mandatory rather than optional. Our Microsoft vs Google Authenticator comparison covers how the implementations differ.
Push versus TOTP: which is actually better?
| Push (with number matching) | TOTP code | |
|---|---|---|
| Works offline | No | Yes |
| Resists prompt bombing | Yes | N/A — no prompts |
| Resists real-time phishing | Partially | No |
| Shows login context (location, app) | Yes | No |
| Speed | Faster | Slower |
| Works on any service | No — vendor-specific | Yes — open standard |
Push has one genuine advantage people overlook: it tells you when someone else has your password. An unexpected prompt is a live alert that credentials have leaked. A TOTP app never notifies you of anything.
Its disadvantages are that it needs connectivity and only works with services that build it. TOTP is an open standard any app can implement — see how TOTP codes work.
What to do if you get a prompt you did not trigger
- Deny it. Always. Never approve to make notifications stop.
- Change that account’s password immediately. An unexpected prompt means someone has your current one.
- Check for reuse. If that password appears anywhere else, change it there too.
- Report it to your IT team if it is a work account — you may be one of many being targeted.
- Sign out all sessions in the account’s security settings.
- Never approve based on a phone call. No legitimate IT department will ever ask you to approve a prompt they triggered. The same trick drives many OTP scams carried out by phone.
Frequently asked questions
Is push notification 2FA safe?
With number matching, yes — it is comparable to TOTP and more convenient. Without it, prompt bombing is a real and demonstrated risk.
Can an attacker approve the prompt themselves?
No. The prompt goes to your registered device and requires your unlock. The attack works by manipulating you into approving, which is why number matching is effective.
Does push 2FA stop phishing?
Partly. Prompts show context like location and application, which can reveal an attack. But a real-time phishing proxy can still trigger a legitimate prompt that you approve believing it is your own login. Only passkeys and hardware keys are structurally immune — see passkeys vs 2FA.
What if I have no internet?
Push fails without connectivity. Most services offering push also provide a TOTP fallback in the same app. Keep offline backup codes regardless.
Should I use push or codes at work?
Use whatever your organisation mandates. If you have a choice, push with number matching is the better daily experience and gives you an alert when your password leaks. If you are configuring it yourself, see our guide to setting up 2FA on a Microsoft account.
The bottom line
Push 2FA is a good method undermined by one bad implementation choice. Insist on number matching, deny anything you did not initiate, and treat an unexpected prompt as what it is — proof that someone already has your password.