Every evening, somewhere between the last work email and the first proper cup of tea, millions of people in the UK hit a small wall. A prompt appears asking them to confirm something they have already confirmed, or to approve a login they are already halfway through. The task itself is trivial. The delay is not. When researchers timed two-factor authentication challenges during evening hours, they found a consistent penalty of roughly 3.1 seconds per prompt compared with the same prompts issued mid-morning. That figure is small enough to sound like noise and large enough, multiplied across a workforce, to matter. The interesting question is not whether it happens, but why a security measure designed to protect a decision ends up degrading the decision-making around it.

The evening brain is not the morning brain

The 3.1-second figure is best understood as a measurement of cognitive state rather than of the interface. The same prompt, the same phone, the same person, different hour. What changes is the availability of what psychologists call executive resources: working memory, attentional control, and the capacity to inhibit an automatic response in favour of a deliberate one.

Daniel Kahneman's distinction between System 1 and System 2 thinking is useful here, if somewhat overused. System 1 is fast, associative, and cheap. System 2 is slow, effortful, and metabolically expensive. By 8pm, for most people, System 2 has been running for twelve or fourteen hours. It is not switched off, but it is reluctant. A two-factor prompt is a System 2 task dressed up as a System 1 task: it looks like a tap, but it requires verification, context-switching, and a judgement about whether the request is legitimate.

That judgement is where the seconds go. The user is not merely reading a code. They are, often unconsciously, running a risk assessment: did I initiate this? Is this the app I expected? Does the timing make sense? Under fatigue, that assessment is slower and less reliable. The 3.1 seconds is the visible cost. The invisible cost is the increase in errors, both false approvals and abandoned legitimate attempts.

Why the penalty is larger than it looks

Three seconds feels negligible in isolation. It is not negligible in aggregate, and it is not negligible in kind. Research on decision fatigue, going back to Roy Baumeister's work on ego depletion (itself now contested in detail but robust in direction), suggests that the quality of decisions degrades alongside speed. A slower verification at 8pm is often a less careful verification. The person is not deliberating more. They are deliberating worse, and the extra time is the friction of a tired mind trying to complete a task it has already completed forty times that week.

Variable prompts and the reward-loop problem

There is a second, less discussed factor. Two-factor prompts are not issued on a fixed schedule. They arrive unpredictably, sometimes clustered, sometimes absent for days. From the user's perspective, this is a variable-ratio pattern: an action (checking the phone, opening the app) is sometimes rewarded with a successful login and sometimes not, because the prompt itself is inconsistent.

Variable-ratio reinforcement is one of the most thoroughly documented phenomena in behavioural psychology, associated with B.F. Skinner's work on operant conditioning and subsequently with the persistence of habits that are hard to extinguish. The mechanism is straightforward: unpredictable reward schedules produce the most durable and most compulsive response patterns. This is normally discussed in the context of consumer apps and notification design, and rightly so. But it applies equally to security prompts, which are, functionally, unpredictable interruptions attached to a required action.

The consequence is that users develop a scanning habit rather than a verifying habit. They learn to respond to the shape of the prompt rather than its content. At 8pm, when attentional control is lowest, that habit is strongest. The 3.1 seconds is partly the time taken to override the habit and actually read the thing.

Loss aversion and the asymmetry of the prompt

Kahneman and Tversky's work on loss aversion established that losses loom larger than equivalent gains. A two-factor prompt presents the user with a small, immediate, certain loss: three seconds, a context switch, a minor irritation. The gain it offers is probabilistic and abstract: reduced risk of account compromise, a threat that most people have never directly experienced.

This asymmetry explains a great deal of the friction around security prompts. The user is not irrational to find them annoying. They are responding to a genuine imbalance between a concrete present cost and a diffuse future benefit. The 3.1-second evening penalty is the measurable surface of that imbalance. The deeper issue is that the prompt is asking the user to make a rational trade-off at the precise moment when rational trade-offs are hardest.

What the timing data actually suggests

If the penalty is concentrated in the evening, the obvious fix is to reconsider when prompts are issued. Some organisations have experimented with batching non-urgent verification requests into working hours, or with shifting low-risk prompts to a passive authentication method that requires no user action at all. The early results are modest but consistent: fewer abandoned sessions, fewer support tickets, and no measurable increase in successful unauthorised access. The security was not weakened by reducing the number of active prompts. It was, if anything, strengthened, because the prompts that remained were taken more seriously.

Competitive contexts sharpen the same effect

The pattern is not confined to security. Any domain that combines intermittent reward, time pressure, and a required decision under uncertainty produces the same evening degradation. Competitive online environments, from ranked multiplayer games to trading platforms to fantasy leagues, show comparable timing effects: reaction times lengthen, risk-taking increases, and the willingness to override a gut response falls.

This is well documented in the decision-making literature. What is less often noted is that the design of these environments frequently amplifies the effect rather than mitigating it. Streaks, daily bonuses, and time-limited opportunities all exploit the same variable-ratio structure, and all of them are most active in the evening, when the user's capacity to resist is lowest. The 3.1-second figure is not a curiosity about authentication. It is a general measurement of a specific vulnerability window.

Designing for the 8pm user

The forward-looking question is not how to make people faster at 8pm. It is how to stop asking them to be fast at 8pm. Three practical directions are emerging.

First, shift the burden of proof. A prompt that requires the user to verify a legitimate action is a prompt that has failed to establish trust in the first place. Passive signals, such as device continuity and behavioural biometrics, can carry more of the load without asking anything of a tired person.

Second, respect the rhythm. If evening decisions are measurably worse, then non-urgent decisions should not be scheduled for the evening. This applies to security prompts, but equally to subscription confirmations, consent requests, and any other decision that benefits from a clear head.

Third, treat the 3.1 seconds as a diagnostic, not a rounding error. It is a signal that the system is asking the wrong person, at the wrong time, to do the wrong amount of work. The organisations that act on that signal first will not just save time. They will get better decisions, from people who are no longer being asked to make them at the worst possible moment.