Friction matters because abandonment is a governance outcome, not just a UX outcome. When users stop midway through verification, institutions lose conversion and may push customers toward weaker or less secure alternatives, which undermines both security and assurance.
Why onboarding friction changes the security equation
Friction matters because digital identity onboarding is not just a conversion funnel, it is the first place where assurance, fraud resistance, and user trust are tested together. If verification is slow, confusing, or repetitive, legitimate users abandon the process, and that abandonment becomes a control problem because the organisation loses both completed identities and confidence in the journey.
The practical issue is that friction does not stay neutral. It changes who finishes onboarding, which fallback channels users choose, and whether the institution is pushed toward weaker paths such as simplified verification, manual exception handling, or inconsistent step-up checks. In other words, onboarding design influences the effective security level of the identity estate, not just the completion rate.
For digital identity programmes, that means the onboarding experience is part of the assurance model. A process that is too hard can indirectly create a larger attack surface by encouraging workarounds, while a process that is too easy can admit more impersonation, synthetic identities, or low-confidence enrolments. The balance is not theoretical, it is operational.
Where friction becomes a control failure
Friction becomes a control failure when the organisation treats abandonment as a UX metric and ignores the downstream security and governance effects. If users repeatedly drop out at document capture, liveness, or identity proofing steps, the business may respond by loosening checks, shortening review paths, or allowing alternate verification routes that are less consistent and harder to govern.
This is why onboarding quality matters as much as onboarding speed. A brittle journey can create a split population, where some identities are strongly verified and others are admitted through exceptions that are difficult to audit later. That inconsistency weakens assurance, complicates risk scoring, and can make later controls less trustworthy because the original enrolment evidence was incomplete.
Friction also affects channel integrity. When a primary onboarding route is painful, users may migrate to support-assisted or manual flows, where identity decisions become more dependent on human judgement and less repeatable across cases. The result is often more operational variance, not less risk.
How to think about the onboarding trade-off
Good onboarding is not the absence of friction. It is the reduction of unnecessary friction while preserving the specific checks that make the identity trustworthy. The key question is not how many steps can be removed, but which steps materially improve confidence and which steps only add delay, confusion, or repeated effort.
That distinction is important because different signals have different value. Requiring users to repeat the same information, re-enter data after a failed submission, or restart a session after a timeout adds friction without necessarily adding assurance. By contrast, a well-placed step-up check or a stronger proofing requirement may be frictional but still justified if it materially improves identity confidence.
For practitioners, the design problem is to keep the flow legible, short enough to complete, and strict enough to resist abuse. The best onboarding journeys are usually the ones that remove accidental friction first, then preserve deliberate friction only where it changes the risk profile.
Risk and Threat Considerations
High-friction onboarding can drive abandonment, exception handling, and weak fallback paths, all of which create security exposure if the organisation responds by relaxing checks to preserve conversion. Low-friction onboarding can also be dangerous when it allows imposters, synthetic identities, or low-confidence enrolments to pass with too little scrutiny.
Failure mechanism: The system either loses legitimate users because the journey is too hard, or it compensates by weakening proofing and review controls, which creates inconsistent assurance and a larger opportunity for fraud or account abuse.
Impact: Poorly balanced friction can reduce conversion, increase manual workload, undermine trust in the identity proofing process, and leave the organisation with a larger pool of identities whose assurance level does not match their access or business importance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, OWASP ASVS, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Onboarding friction directly affects identity proofing, authenticator choices, and assurance outcomes. |
| Recommendation — Apply NIST 800-63 assurance principles to keep proofing strict enough while minimizing unnecessary user drop-off. | ||
| OWASP ASVS | V6 — Authentication | The onboarding flow is where authentication and account establishment must remain usable and resistant to abuse. |
| Recommendation — Verify onboarding and authentication steps for clarity, resilience, and resistance to bypass or confusion. | ||
| NIST CSF 2.0 | PR.AA-05 — Identities and credentials are managed commensurate with risk | Identity onboarding sets the credential and access assurance baseline for later protection and governance. |
| Recommendation — Align onboarding controls to risk so completed identities receive assurance proportional to their intended access. | ||
| CIS Controls v8 | 5 — Account Management | Onboarding creates accounts and determines the quality of account lifecycle handling from the start. |
| Recommendation — Standardize account onboarding so identity creation, validation, and exception handling remain controlled. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Digital identity onboarding is a core identity-management process that must be governed and auditable. |
| Recommendation — Define and govern onboarding identity checks so assurance decisions are consistent and auditable. | ||
Practitioner Guidance
What to prioritise: Treat onboarding drop-off points as control signals, not just product metrics. If a specific step causes abandonment, determine whether the step is essential to assurance or merely an implementation burden.
What to verify: Check whether fallback routes preserve the same identity confidence as the primary route. If an exception path is easier than the standard path, it often becomes the path users and attackers both prefer.
Common mistake: Reducing friction by removing verification steps instead of removing duplicate effort, unclear instructions, and session instability. The former weakens assurance; the latter improves completion without sacrificing control.
What good looks like: The onboarding journey is fast enough to complete, explicit enough to understand, and consistent enough that completed identities can be trusted without relying on ad hoc human interpretation.
Practitioner takeaway: The right measure is not friction versus no friction, but whether every required step earns its place by improving assurance more than it harms completion.
Related resources from NHI Mgmt Group
- Guide: Digital Identity, eID and Identity Wallets Guide
- Why do service desk and onboarding processes matter so much in identity security?
- Why does identity matter so much in healthcare digital transformation?
- How should organisations use government digital identity systems to reduce onboarding friction without weakening identity assurance?
- Why do reusable digital identity credentials matter for compliance in Web3 onboarding?