How should teams add user friction without damaging the customer experience?

Teams should reserve friction for moments where the risk or consequence is high, then make the check feel intentional and proportionate. Good friction confirms identity, intent, or payment legitimacy without slowing routine actions. The goal is to reduce fraud and costly mistakes while preserving a smooth path for low risk activity and trusted users.

When Friction Helps and When It Just Adds Drop-Off

user friction is worth adding only when it protects a step where abuse, fraud, account takeover, or irreversible error would be materially worse than a brief pause. The best controls are risk-based and legible: a step-up check, a confirmation, or a re-authentication prompt should feel tied to the action, not like a random obstacle. That distinction matters because poorly timed friction trains users to bypass controls, abandon tasks, or treat security prompts as noise.

For teams working on customer journeys, the real design problem is not whether to add friction, but where to place it so that high-risk actions get extra scrutiny while routine actions stay fast. A useful rule is that friction should increase with consequence, not with how often a page is visited. That approach is especially relevant when identity trust, payment legitimacy, or privileged actions are involved. In practice, many security teams encounter prompt fatigue only after users have learned to ignore checks that were added without a clear risk trigger.

How to Make Security Checks Feel Proportionate

Well-designed friction works because it narrows the decision to a specific concern. If the question is “Is this really you?”, the control should verify identity. If the question is “Did you really mean to do that?”, the control should confirm intent. If the question is “Is this payment or transfer abnormal?”, the control should validate the transaction context. Each of those checks has a different purpose, so the timing, wording, and severity should differ as well.

Teams usually get the best balance when they treat friction as a graduated response rather than a fixed gate. Low-risk behaviour should move with minimal interruption. Medium-risk events can trigger lightweight confirmation. High-risk events can justify stronger authentication, approval, or delay. The key is consistency: users should see the same kind of challenge for the same kind of risk, so the interaction feels predictable rather than arbitrary.

Use risk signals such as new device use, unusual location, sensitive data access, or unusual payment patterns to decide when to step up.
Keep the message specific to the action so users understand why the check exists.
Prefer fast, familiar checks for routine actions and reserve heavier checks for high-impact events.
Measure abandonment, override rates, and repeated prompt failures to see whether the friction is helping or harming.

For related identity-bound control patterns, OWASP Non-Human Identity Top 10 is useful when the friction question extends to automated actors, service credentials, or delegated access rather than only human users. The guidance breaks down when teams apply the same challenge to every user and every action, because uniform friction quickly becomes indistinguishable from a broken product.

Where Friction Strategy Breaks Down in Real Journeys

Tighter security controls often increase abandonment and support demand, so organisations have to balance fraud reduction against the cost of interrupting legitimate users. That trade-off becomes sharper when a journey is time-sensitive, emotionally charged, or mobile-first, because even a small delay can feel disproportionate.

There are a few common edge cases. First, some actions are low frequency but extremely sensitive, such as account recovery or payout changes, and they deserve stronger friction even if they are rare. Second, some users are already operating in a high-trust context, such as managed enterprise access or known customer profiles, where repeated challenges can be counterproductive. Third, accessibility matters: friction that depends on cognitive load, device availability, or perfect network conditions can exclude legitimate users and create a different kind of business risk. Where teams disagree, the debate is usually not whether friction exists, but whether it should be visible, adaptive, or deferred until a higher-risk moment.

Good practice is to treat the experience as a control surface, not a punishment. If the step cannot be explained in one short sentence, or if it appears during routine actions more often than during risky ones, the design usually needs rework.

Risk and Threat Considerations

Friction is not just a UX choice. If it is too weak, attackers and fraudsters get an easier path through account recovery, payment changes, approval workflows, or other high-value actions. If it is too heavy or poorly targeted, legitimate users learn to mistrust prompts, creating workarounds that reduce control effectiveness.

Failure mechanism: The risk materialises when a control is applied without adequate context, so the same challenge appears for both routine and high-risk actions. That creates either under-protection, where suspicious activity passes too easily, or over-challenge, where users are conditioned to ignore prompts, reuse weak recovery paths, or abandon secure flows for less controlled ones.

Impact: The likely consequence is higher fraud loss, more account compromise through weaker fallback paths, more support overhead, and lower conversion on legitimate journeys. Over time, the organisation can lose both trust and detection value because users stop treating the friction as a meaningful security signal.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	User friction often means step-up authentication at sensitive actions.
Recommendation — Apply PR.AA controls to step up verification only when action risk justifies the interruption.
CIS Controls v8	6 — Access Control Management	Friction is a control decision about when and how access should be challenged.
Recommendation — Use access control rules to make higher-risk actions require stronger user verification.
OWASP Non-Human Identity Top 10	NHI-01 — Inventory and Ownership	When friction affects automated identities or delegated access, ownership and context matter.
Recommendation — Inventory machine identities so step-up checks are applied to the right actor and workflow.
MITRE ATT&CK	T1110 — Brute Force	Friction can slow automated abuse that relies on repeated auth attempts.
Recommendation — Add targeted challenge points to disrupt automated authentication abuse and credential attacks.
NIST SP 800-63	IAL2 — Identity Assurance Level 2	Proportionate friction is often implemented through stronger identity proofing or re-authentication.
Recommendation — Align stronger verification with higher-assurance events instead of burdening every user flow.

Practitioner Guidance

What to prioritise: Start with the highest-consequence actions first, not the busiest screens. Recovery, payout, privilege change, and payment-related steps usually deserve more scrutiny than ordinary navigation or profile browsing.

Decision rule: If the added check cannot be explained as “this step changes risk materially,” it is probably too blunt. If the team cannot articulate what the control is verifying, whether identity, intent, or legitimacy, the friction will likely feel arbitrary and perform poorly.

What to measure: Track completion rate, challenge success rate, repeat challenge rate, and downstream fraud or support impact together. A friction change that reduces abuse but sharply increases abandonment may still be the wrong design if the net business effect is negative.

Practitioner takeaway: The most effective friction is selective, understandable, and tied to consequence; once it stops feeling proportionate, it stops working as security.