

Requires 2FA for login, but doesn’t support time-based authenticator codes / setting up an authenticator app
Code is successfully emailed / sent via SMS
“Code is invalid. Please try again.”
Also, any system where the code is requested but never arrives.
The average user of any system doesn’t care about security until after they’re suffering consequences, at which point they’re quick to blame every external party