the agent's browser automation failed on the bank portal login when the MFA push never arrived

TL;DR

MFA push requires a human with a phone, which an unattended agent cannot supply, so the login hangs until it times out. The durable answer is to remove the human step from the machine path: use the bank's API, file delivery, or a service credential channel for the data the automation needs. Where the portal is the only channel, the agent must pause and request human MFA approval through the approved flow, with a clear message and a bounded wait, rather than looping on a push that will never be approved.

the agent's browser automation failed on the bank portal login when the MFA push never arrived

Use this when

• Browser automation reaches the login, enters credentials, and stalls waiting for MFA approval.
• No human is available or assigned to approve the push during the automated run.
• The portal offers no API or file alternative that the team has tried yet.

Not for this skill when

• Credentials themselves are wrong. The MFA step is never the first failure; fix the login first.
• MFA works but is flaky, arriving late sometimes. Then a bounded wait with a retry policy may suffice, though a better channel is still preferable.

Steps

1. Confirm the stall is MFA: credentials accepted, push or code prompt presented, nothing the agent can answer. Verify: the automation state shows the MFA challenge explicitly
2. Check whether the bank offers an API, SFTP delivery, or a service account for the needed statements or data. Verify: the available machine channels are listed from the bank's documentation or support
3. If a machine channel exists, migrate the job to it and retire the browser login for this task. Verify: the job completes without any interactive step
4. If no channel exists, add a human-approval step: the agent pauses, notifies the designated approver with context and a deadline, and resumes on approval. Verify: the pause and resume path is tested end to end
5. Bound the wait with a timeout that exits cleanly with a report, never a crash. Verify: an unapproved MFA challenge ends in a reported incomplete state

Variant phrasings

bank portal MFA push never arrived browser automation agent

The MFA-blocked phrasing.

agent login MFA unattended automation API alternative

When moving off the portal.

Compatibility: Browser automation against bank portals with MFA, and bank API or file delivery alternatives.

Why it happens

MFA exists to prove a human is present, which directly contradicts unattended automation. Banks enforce it precisely on portal logins, and automating around it, by approving pushes automatically or scripting code entry, defeats the control and often violates the bank's terms. The legitimate exits are channels designed for machines, which banks provide for business customers, or explicit human participation at the MFA step, which keeps the control intact while letting the agent do the rest.

Edge cases / pitfalls

• Dedicated read-only service users with IP allowlisting are the pattern banks support for business automation; ask for it by name.
• Never share an employee's personal MFA device with an automation job; that personalises a control that must stay personal.
• If the human-approval path is used, rotate approvers and log approvals; a single always-approving human becomes the weakest link.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YpOL-JNJFz9qnkUPZWVy2g