Push-based multi-factor authentication fails when attackers simply send approval prompts until someone taps accept out of exhaustion or confusion.