← Years 7–8 Digital Systems

Limits of MFA

A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

Part of: 7-8 Digital Technologies Vic Curric - Digital Systems and Security — Module 61, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 31, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 45, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 44, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 111, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 73, WA Computer Science ATAR Year 11 — Cyber Security — Module 105

Understanding Limits of MFA in Years 7–8 Digital Systems

What it does: Giving in to repeated prompts is how MFA fatigue works. The correct response is to deny every prompt and report them. Denying, keeping your code private and reporting the attempt stops the scammer and warns the account owner or provider. MFA is a strong protection, but scammers can beat it by tricking people into sharing codes or approving prompts. Scammers use pressure and urgency. Codes are only for you to type in when you start a login. Only approve prompts for logins you started. If you did not start it, it is not safe to approve. The caller is a scammer. Sharing the code lets them log in, so the code should stay secret and the call should be reported.

Common mistakes: Scammers use a stolen password and then ask you for the MFA code. Never share a code with anyone. The line should be 'keep the code secret'. If you did not start the login, someone else is trying to get in. Approving lets them in. The line should be 'DENY the prompt'.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Limits of MFA to a class →

This module's key terms are also in a printable crossword (Modules 26–74) and word search (Modules 4–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A caller says they are from your bank and asks you to read out the 6-digit code just texted to you. What should you do?

Read the code out because they work for the bankHang up and never share the code

Matches

"My MFA code is private, but I'll tell the helpful 'bank worker' who rang me."

↓

MFA codes must never be shared with anyone, even someone who claims to be from a bank or company. Real staff never ask for them.

Applying

Meanings

Term

MFA fatigue

Meaning

A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

Practice

IF I did not start the login THEN

Testing

Gaps

prompt

Check Answer

Spots

1IF caller asks for my code

2 read the code to the caller

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A caller says they are from your bank and asks you to read out the 6-digit code just texted to you. What should you do?

A. Read the code out because they work for the bank

B. Hang up and never share the code ✓

A real bank will never ask for your MFA code. A scammer who has your password needs that code to get in, so sharing it hands over your account.

2. Your phone buzzes with a login approval prompt, but you did not try to log in. What should you do?

A. Tap approve to make the buzzing stop

B. Deny the prompt and report it ✓

A prompt you did not start means someone may have your password. Deny it, change your password and report it.

3. True or false: MFA makes an account impossible to break into.

A. False. A tricked user can still hand over the second factor ✓

B. True. MFA can never be beaten

MFA is a strong protection, but scammers can beat it by tricking people into sharing codes or approving prompts.

4. Which is an example of MFA fatigue?

A. A scammer sends lots of login prompts hoping you approve one ✓

B. You get one prompt after you log in yourself

MFA fatigue is when a scammer keeps sending prompts so you get tired or annoyed and tap approve just to stop them.

5. A message says: 'Reply with the code we just sent you to keep your account.' Which choice is safest?

A. Ignore the message and do not share the code ✓

B. Reply quickly with the code so you do not lose your account

Scammers use pressure and urgency. Codes are only for you to type in when you start a login.

Match the Pairs

Scammer: "Read me the code we just texted you." → A scammer tricking you into handing over your MFA code so they can log in as you.

Prompt: "Approve sign-in?" (you did not log in) → An unexpected MFA prompt that you should deny and report, not approve.

MFA fatigue: a scammer spams prompts hoping you tap Approve just to make them stop → 10 prompts at midnight -> tap Approve to stop them

The safe response to a prompt or code request you did not start → Deny the prompt, never share the code, report it

"My MFA code is private, but I'll tell the helpful 'bank worker' who rang me." → MFA codes must never be shared with anyone, even someone who claims to be from a bank or company. Real staff never ask for them.

"I got an unexpected sign-in prompt, so I'll tap Approve and ignore it." → Approving a prompt you did not start lets a scammer in. You should deny it, change your password and report it.

Key Term

MFA fatigue

A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

Fill in the Blanks

1. IF unexpectedPrompt THEN DENY prompt

Hint: Type the action word that refuses a login prompt you did not start.

2. IF scammerAsksForCode THEN shareCode ← false

Hint: Type the Boolean value that means your MFA code is NOT shared with the scammer.

3. IF unexpectedPrompt THEN DENY prompt REPORT prompt

Hint: Type the action word that tells your account provider or IT team about the unexpected prompt.

4. IF NOT loginStartedByMe THEN DENY prompt

Hint: Type the logic keyword that flips a condition to its opposite, so prompts you did not start get denied.

5. IF passwordStolen AND codeShared THEN accountAtRisk ← true

Hint: Type the logic keyword that needs both conditions to be true, showing MFA can fail when you share the code.

Spot the Error

Question 1

A IF caller asks for my code

B read the code to the caller

C hang up the call

Line B — Scammers use a stolen password and then ask you for the MFA code. Never share a code with anyone. The line should be 'keep the code secret'.

Question 2

A IF a prompt was not me

B APPROVE the prompt

C CHANGE my password

Line B — If you did not start the login, someone else is trying to get in. Approving lets them in. The line should be 'DENY the prompt'.

Question 3

A prompt_count <- 8

B login_started <- TRUE

C approve <- login_started

Line B — The student did not start a login, so login_started must be FALSE. Setting it to TRUE would make approve TRUE and approve a scammer's prompt.

Question 4

A FUNCTION handle_prompt(mine)

B IF mine = TRUE THEN

C approve

D ELSE approve to stop spam

Line D — Scammers send many prompts hoping you give in and approve one (MFA fatigue). A prompt you did not start should be denied and reported, not approved.

Question 5

A code <- 483921

B scammer_asks <- TRUE

C share_code <- TRUE

D PRINT share_code

Line C — Even when a scammer asks for the code, it must never be shared. share_code should be FALSE.

Student with a class code? Join your class →