---
title: Limitations when using passwordless push authentication
description: Limitations to consider when implementing passwordless push authentication, including unsolicited notifications and the risk of unintentional approval of malicious attempts
component: pingam
version: 8
page_id: pingam:am-authentication:mfa-push-passwordless-limitations
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-authentication/mfa-push-passwordless-limitations.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-06-01T14:34:20Z
keywords: ["Authentication", "Multi-factor Authentication (MFA)"]
page_aliases: ["authentication-guide:mfa-push-passwordless-limitations.adoc"]
superseded_by: https://docs.pingidentity.com/pingam/8.1/am-authentication/mfa-push-passwordless-limitations.html
---

# Limitations when using passwordless push authentication

When authenticating to a passwordless push authentication journey, the user enters their user ID, but not their password. AM sends a push notification to their device to complete the authentication.

Be aware of the following limitations when you implement passwordless push authentication:

* Unsolicited push messages could be sent to a user's registered device by anyone who knew or was able to guess their user ID.

* If a malicious user attempted to authenticate by using push at the same time as a legitimate user, the legitimate user might unintentionally approve the malicious attempt. This is because push notifications only contain the username and issuer in the text, and it is not easy to determine which notification relates to which authentication attempt.

Consider using push notifications as part of MFA, and not on their own.