Cap MFA push bombing. An attacker with a user's password triggers repeated second-factor prompts, hoping the user approves one to stop the noise. Lidar's `mfa_fatigue` monitor surfaces this against a single subject so you can step in before a prompt is approved.

## What you use

- The Lidar `mfa_fatigue` monitor (`detection:mfa_fatigue challenges:>4 window:30m`), correlated by subject.
- Optional: [Bot protection](/docs/bot-protection) on `mfa_verify` (reCAPTCHA **v3** or Turnstile **Invisible**) to add a silent check to the challenge step.

## Setup

1. Confirm [Lidar access](/docs/console/lidar) is approved for the environment.
2. Under **Lidar > Monitors**, enable `mfa_fatigue`. The default `challenges:>4 window:30m` is a starting point; lower `challenges:` for sensitive accounts or raise it if your UX legitimately retries MFA several times.
3. If you want a silent check on the challenge itself, enable reCAPTCHA **v3** or Turnstile **Invisible** on `mfa_verify` under **Authentication > Add-ons**. Visible widgets cannot render on this page.

## Verify

- In dev, trigger MFA for one user more times than the `challenges:` floor within the window: a Signal appears against that subject, deduped by `ai:mfa_fatigue:<subject>:<windowStart>`.
- Confirm a user retrying MFA two or three times does not fire; the monitor keys on volume, not single retries.
- Triage the Signal in [Lidar > Signals](/docs/console/lidar); suspending the user or rotating keys invalidates outstanding sessions on the next `userinfo` check.

## Related

- [MFA](/docs/mfa): the TOTP second factor this recipe protects.
- [Lidar concepts](/docs/concepts/lidar): subject-keyed correlation and dedup.
- [Security](/docs/security): session revocation and key rotation.