Approval-based multi-factor authentication can still fail when repeated login prompts wear down the user, turning a security control into a shortcut for account access.