The Verification Illusion: Hardening Push-Based MFA with Context-Rich Number Matching

Push-based multi-factor authentication (MFA) is widely deployed but vulnerable to MFA-fatigue (“push bombing”) and concurrent login attacks. Number matching requiring users to transcribe a code from the login screen mitigates accidental approvals, yet its security rests on the untested assumption: that users actually verify the code before approving. We test this assumption using per-participant data from a controlled push-MFA study (N = 73,829 attack trials) and find it empirically unfounded.

We document the Verification Illusion: participants who reported “always” verifying exhibited the highest false-approval rate (FAR) of any group (53.7%), with one-third approving every attack. Security confidence was inversely related to attack resistance (p = 0.011). Vulnerability was strongly bimodal (bimodality coefficient = 0.775): 26% of participants approved every attack while 13.7% denied all, with stable individual differences accounting for 58.8% of variance far exceeding device type or code length.

Faster responders showed substantially higher FAR (58.4% vs. 38.7%; Cohen’s d = 0.51), consistent with reflexive rather than deliberative approval. These findings motivate Context-Rich Number Matching (CRNM), a policy primitive binding push notifications to the relying-party origin and a strict time window.

Counterfactual simulation shows CRNM provides a deterministic, fatigue-independent FAR reduction proportional to cross-origin attack prevalence: 9.9 percentage points at 20% prevalence, 24.7 points at 50% while clipping fewer than 1.1% of legitimate approvals under a 30-second window. CRNM requires no new hardware; it operationalises existing platform bindings (iOS Universal Links, Android App Links) and identity-provider context as enforceable gates, positioning it as a pragmatic bridge between legacy push MFA and phishing-resistant authenticators such as FIDO2/WebAuthn.