Push fatigue is a process failure, not a user failure

Repeated approval prompts train people to approve. Number matching and origin binding remove the ambiguity that makes the attack work, and both have been available for years.

Organisations that still run plain push notifications are carrying a known, documented risk for the sake of a slightly smoother login.