How should organisations implement two-factor authentication in high-risk digital services without creating unnecessary user friction?

How to choose a second factor for high-risk access

The right factor depends on the trust boundary you are trying to protect. For high-risk digital services, the second factor should be resistant to phishing, relay, and interception, because those are the paths most likely to defeat weak 2FA at scale. That is why app-based codes or push approval with strong anti-fatigue controls usually fit privileged and high-value access better than SMS.

SMS still has a place when reach and speed matter more than maximum assurance, but it should be treated as a lower-assurance option rather than a universal default. The practical design question is not “do we have 2FA?” but “does this factor meaningfully reduce the attack path for this user and action?”

For a practitioner reference on method choice, fallback handling, and phishing-resistant rollout, use Two-Factor Authentication for Everyone Guide and the MFA Guide.

How to reduce friction without weakening assurance

The cleanest way to reduce friction is to reserve stronger prompts for higher-risk moments and keep the low-risk path simple. Step-up authentication lets organisations ask for more assurance only when the account state, device, location, transaction value, or action sensitivity changes materially.

That usually means fewer prompts during routine activity, clearer enrolment at first use, and predictable recovery when a user loses a device. Good design also removes accidental friction, such as repeated prompts caused by poor session settings, and it avoids adding rules that create too many exceptions for support teams to manage.

If you need a design pattern for risk signals, thresholds, and step-up logic, the Risk-Based and Adaptive Authentication Guide is the most direct internal reference. For a general rollout pattern that covers enrolment and recovery decisions, see the Workforce Identity Security Guide.

What good implementation looks like in practice

A strong deployment starts with policy, not just technology. High-risk applications should require a phishing-resistant or at least app-based second factor for privileged users, administrators, and sensitive transactions, while lower-risk journeys can accept SMS where business reach is the main constraint.

Implementation should also define who can enroll factors, how backup methods are issued, when reauthentication is required, and how failures are monitored. If users can switch to weaker factors without oversight, or if recovery paths are easier to abuse than the main login flow, the friction problem is solved at the cost of exposure.

For hardening and policy precedence around push approvals, bypass controls, and admin permissions, see the Duo Hardening Guide. For attack patterns to design against, the MFA Fatigue and Bypass Guide and OTP security explain the main failure modes.

Risk and Threat Considerations

High-risk digital services are attractive targets because a successful second-factor bypass can expose privileged access, sensitive data, or high-value transactions. The main risk is not that 2FA is absent, but that the chosen factor is easy to intercept, socially engineer, or exhaust through push fatigue.

Failure mechanism: SMS can be weakened by SIM swap, telecom interception, or code relay; push-based approval can be weakened by fatigue attacks and user habituation; any weak recovery path can be used to bypass the stronger login path entirely.

Impact: Attackers can turn a low-friction control into a false sense of security, then move from account takeover to privileged actions, fraud, data access, or further lateral movement if the service is tied to broader enterprise access.

Practitioner Guidance

What to prioritise: Put your strongest factor on the highest-value actions first, not on every user equally. Administrator, finance, and support workflows deserve stricter factor selection and tighter recovery than low-risk customer sign-in journeys.

What to verify: Check that step-up rules are triggered by meaningful risk signals, that recovery does not silently downgrade assurance, and that users are not pushed back to SMS simply because initial enrolment was faster.

Common mistake: Treating “2FA enabled” as the finish line. In practice, the real control quality depends on factor strength, recovery design, and whether the organisation can observe and respond to abnormal enrolment or approval patterns.

Practitioner takeaway: The best balance of security and usability comes from making strong authentication the default for high-risk actions, then limiting friction by prompting only when risk rises, not by weakening the control everywhere.

Related resources from NHI Mgmt Group

• Two-Factor Authentication
• User Friction
• How should government agencies implement identity verification at high-risk service moments without creating unnecessary friction for legitimate users?
• How should security teams implement identity-based authentication in high-risk environments without creating a worse user experience?