How should organisations reduce customer friction when passwords block access to secure online services?

Organisations should treat password friction as a conversion and trust problem, not just an authentication inconvenience. If users repeatedly request resets or abandon transactions, the login journey is failing. Replace or supplement passwords with stronger, lower-friction methods for appropriate risk levels, then reserve step-up checks for sensitive actions. The goal is to let legitimate users complete access quickly without weakening assurance.

When password friction becomes a service design problem

Password friction is often a signal that the access model is too rigid for the service being offered. If legitimate users struggle to sign in, reset passwords, or recover accounts, the organisation is paying for that failure in abandonment, call-centre load, and lost trust. The right response is to reduce repeated proof of knowledge and move toward lower-friction, stronger methods where risk allows.

That usually means offering passwordless or stronger primary authentication for routine access, then keeping high-assurance checks for step-up moments such as changing profile details, moving money, or exporting sensitive data. For secure services, the user journey should feel simple at the start and stricter only when the action justifies it.

Well-designed friction reduction is not the same as lowering assurance. It is about matching the authentication burden to the transaction risk so users are not forced through a high-cost process every time they open the service.

Why resets, lockouts, and repeated prompts create avoidable friction

Most password pain comes from predictable failure modes: forgotten secrets, expired passwords, repeated MFA prompts, and account recovery flows that are slower than the task itself. Once users begin to view login as a barrier, they are more likely to reuse passwords, choose weaker ones, or avoid the service entirely. That creates both usability and security debt.

Secure online services should therefore treat account recovery as part of the authentication design, not a help-desk afterthought. Recovery flows need to be fast enough for legitimate users, but controlled enough that an attacker cannot exploit them as a weaker back door. If the recovery path is easier to abuse than the sign-in path is to complete, the user experience may improve while overall assurance gets worse.

Organisations should also watch for step-up fatigue. If a user is challenged too often for low-risk activity, the control stops feeling protective and starts looking random. The result is lower compliance with the very controls that were meant to strengthen access.

How to cut friction without weakening access assurance

The practical design pattern is to separate routine access from sensitive action access. Use a lower-friction primary method for everyday sign-in, then apply stronger checks only when the user is attempting an action that changes risk, privilege, or data exposure. This lets the majority of sessions stay fast while preserving assurance where it matters.

Where possible, prefer authenticators that do not depend on memorised secrets alone. For many services, that means moving away from repeated password entry toward methods that are harder to phish and easier to use consistently. In parallel, simplify recovery and reduce the number of reasons a legitimate user is forced back to password reset.

Any change should be measured against abandonment rate, reset volume, help-desk contacts, and the proportion of sessions that require step-up. If those numbers improve without an increase in suspicious access or recovery abuse, the new flow is doing the right job.

Risk and Threat Considerations

Excessive password friction creates two risks at once: it drives legitimate users away from secure services, and it encourages unsafe workarounds such as password reuse, reset loops, or over-reliance on fallback channels. Attackers also benefit when organisations compensate for poor usability by making recovery or exception handling too permissive.

Failure mechanism: Users abandon the flow or normalise weak behaviour because the authentication journey is too burdensome, while attackers target the easiest alternate path, often recovery, fallback, or social engineering around support processes.

Impact: The organisation loses both conversion and assurance, with more support cost, more account compromise opportunities, and weaker confidence that legitimate users can complete high-value actions quickly.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	Passwords, MFA, and login friction directly affect user authentication design.
	IA-5 — Authenticator Management	Password resets and recovery flows are authenticator lifecycle issues.
	AC-7 — Unsuccessful Logon Attempts	Repeated login failures and lockouts are a core friction signal.
Recommendation — Reduce unnecessary password prompts and support stronger primary authentication for routine access. Tighten authenticator recovery, rotation, and replacement to cut reset-driven friction. Tune lockout and retry handling so legitimate users are not trapped by avoidable failures.
ISO/IEC 27001:2022	A.5.15 — Access control	Access control governance should shape how users reach secure online services.
	A.8.5 — Secure authentication	Lower-friction authentication methods must still provide adequate assurance.
	A.8.2 — Privileged access rights	Step-up checks and sensitive actions are tied to elevated access decisions.
Recommendation — Define access routes that match business risk and avoid forcing password use where better options exist. Select authentication methods that reduce user effort without weakening trust in the session. Require stronger verification before privilege-changing or high-impact actions.
CIS Controls v8	CIS-5 — Account Management	Reducing password friction depends on better account lifecycle and recovery handling.
Recommendation — Streamline account and authenticator management so users are not blocked by avoidable resets.

Practitioner Guidance

What to prioritise: Start by identifying where friction is actually occurring, reset requests, failed sign-ins, repeated MFA prompts, and abandonment at sensitive steps. The most useful fix is usually not “make passwords stricter,” but “remove unnecessary authentication repetition while preserving step-up for meaningful risk.”

What to verify: Check that the recovery path is no easier to abuse than the main sign-in path is to complete. A good design reduces user effort without turning fallback into the weakest link.

Practitioner takeaway: The best experience is not the least secure one, it is the one that makes routine access easy, makes high-risk actions deliberate, and keeps the recovery path from becoming the real attack surface.