Multi-factor authentication fatigue attack