Because users usually experience the friction immediately and the fraud risk abstractly. If signup feels slow, they default to guest checkout even when they understand the threat. Identity teams need to reduce visible effort while preserving enough assurance to prevent low-quality registrations and abuse.
Why friction wins even when fraud feels real
Consumers do not evaluate signup as a pure security decision. They experience the cost immediately in time, attention, and uncertainty, while fraud risk feels delayed and probabilistic. That means even a fraud-aware user can rationally choose the path of least resistance if the registration flow asks for too much too soon, or if the value of creating an account is not yet obvious.
The important practitioner signal is that the abandonment is often a design failure, not a trust failure. If the flow adds visible effort before the user has committed to the product, the user will discount the future security benefit and preserve their immediate convenience.
That trade-off is especially pronounced in onboarding and checkout journeys where the user is still testing whether the service is worth the commitment. If the account step looks mandatory, heavy, or fragile, users often infer hidden friction ahead and exit before they ever get to the fraud-sensitive part of the journey.
How risk perception changes at the point of signup
Fraud concern usually does not disappear, but it competes with a stronger near-term question: “How long will this take, and what am I giving up to continue?” Users tend to accept abstract fraud prevention in principle, then abandon when the control surface is too visible, too intrusive, or poorly explained.
This is why stronger security language alone rarely rescues conversion. The user needs a reason to believe that the account step is necessary, proportionate, and not a trap for extra effort. When the control is invisible or poorly framed, it feels like cost without benefit.
A useful way to think about the issue is that consumers are not rejecting assurance, they are rejecting needless ceremony. They will tolerate verification when it is clearly tied to value, but they resist when it looks like the business is shifting operational burden onto them.
What actually reduces abandonment without weakening assurance
The best-performing patterns usually reduce early friction first and add stronger checks only when the risk becomes material. That can mean deferring nonessential fields, shortening the first pass, or using step-up verification only where fraud signals justify it. The goal is to keep the user moving while preserving enough control to stop low-quality registrations and abuse.
Identity teams should also distinguish between user friction and control effectiveness. Some checks create very little protection but a lot of visible effort, while others meaningfully raise fraud cost with less user pain. For example, document verification or liveness checks are more defensible when account opening is high-risk than when the user is only trying to browse or complete a low-value transaction.
When teams design the flow this way, they preserve assurance without making the account step feel like a gate designed to punish legitimate users. That is usually the difference between a control that protects the business and a control that merely drives prospects away.
Risk and Threat Considerations
Friction is not just a conversion problem, it is also a control-shaping problem. If legitimate users abandon because the flow is too heavy, the business may be tempted to relax verification broadly, which can create openings for fake accounts, bot activity, synthetic identity abuse, and lower-quality registrations that later become abuse or loss events.
Failure mechanism: The signup flow exposes cost immediately, while fraud prevention benefits are deferred, so legitimate users exit and the business either loses conversion or weakens controls to recover it. Attackers then benefit from any simplification that removes enough friction to mass-create accounts or blend in with normal onboarding.
Impact: The organisation can end up with both worse conversion and weaker account-quality signals, which increases downstream fraud exposure, support burden, and trust degradation in the customer base.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Signup flows depend on credential setup and lifecycle controls that affect user friction and assurance. |
| Recommendation — Tune credential setup so onboarding remains usable while still enforcing secure authenticator lifecycle controls. | ||
| OWASP ASVS | V6 — Authentication | Account creation friction often comes from authentication and registration controls in the onboarding flow. |
| Recommendation — Balance registration checks with user experience so authentication strength does not block legitimate signups. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account creation quality and access governance shape both fraud resistance and onboarding abandonment. |
| Recommendation — Standardise account provisioning and review steps so access controls stay effective without adding unnecessary signup friction. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Account abuse at scale often follows weak onboarding and poor identity controls that enable credential compromise. |
| Recommendation — Protect onboarding credentials and related secrets so fraud controls are not undermined by exposure. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | The question centers on balancing access assurance with user friction during account creation. |
| Recommendation — Design onboarding so identity assurance is strong enough to block abuse but light enough to keep legitimate users engaged. | ||
Practitioner Guidance
What to prioritise: Reduce visible effort in the first interaction, then reserve stronger assurance for moments where the user’s action or the transaction value justifies it. If the control appears before value is established, expect abandonment even when fraud is a stated concern.
What to verify: Check where users leave, whether the drop is tied to specific fields or verification steps, and whether those steps are actually doing fraud-prevention work. A control that adds delay but does not materially increase confidence should be redesigned, not defended.
Trade-off: Every extra step in onboarding must earn its place by raising assurance more than it raises abandonment. The practical objective is not maximum frictionless signup, but the minimum user burden that still blocks low-quality registrations and abuse.
Practitioner takeaway: Treat signup abandonment as a signal that the control experience is out of balance, then move security later in the journey or make it conditional so legitimate users can progress before they feel the full cost.
Related resources from NHI Mgmt Group
- Why do consumers accept biometric payment cards even when they worry about identity theft?
- Why do consumers keep spending online even when they say they feel pessimistic about the economy?
- Why do consumers still hesitate to use biometric authentication even when they see the convenience?
- Why do non-human identities create compliance risk even when policies exist?