This shows why even strong authentication is fragile if the interface itself can be manipulated. We keep securing the “what,” but forget how easy it is to fake the “where” and “how.”