Acceptable Friction

What Acceptable Friction Means in Fraud Governance

Acceptable friction is not just “less friction is better.” It is the point where added challenge still helps suppress abuse, but does not introduce enough abandonment to damage the business outcome the workflow exists to achieve.

Why Acceptable Friction Exists

Every login, payment, signup, recovery, or step-up check creates a trade-off between trust and conversion. In low-risk paths, heavy challenge can be counterproductive; in high-abuse paths, too little challenge invites fraud, bots, account takeover, and synthetic activity to scale.

The right level depends on the workflow’s value, the attacker’s incentive, the user population, and the control already present around the journey. A one-size-fits-all threshold usually fails because the same control can be tolerable in a checkout flow and harmful in a support or onboarding flow.

How Teams Set the Threshold

Acceptable friction is typically tuned by observing where legitimate users drop off, where suspicious activity declines, and where the control meaningfully changes attacker economics. The goal is not to eliminate every obstacle, but to place enough resistance in the path to make abuse uneconomic without breaking normal use.

Teams usually evaluate this through experiment data, funnel analysis, step-up challenge outcomes, and fraud loss signals. The practical question is whether the added control produces a measurable security gain that justifies the user cost in that specific journey.

Where It Shows Up in Security Design

This concept appears in onboarding, authentication, account recovery, transaction approval, device binding, and risk-based step-up flows. It also affects how teams combine signals, because a single rigid control often creates more user pain than a layered model that escalates only when risk rises.

NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because access, authentication, monitoring, and configuration controls can be combined to reduce abuse without forcing every user through the same burden.

NIST SP 800-63 Digital Identity Guidelines also helps frame how assurance strength and user burden should be balanced in identity flows that must remain usable.

Risk and Threat Considerations

Too little friction can make fraud cheap to scale, while too much friction can drive legitimate users away, increase support load, and create workarounds that weaken the control. The risk is rarely just conversion loss or just abuse, it is the interaction between the two.

Failure mechanism: Attackers exploit weak or absent challenge to automate signups, credential abuse, payment abuse, or account recovery abuse, while legitimate users abandon flows that become slow, confusing, or repetitive.

Impact: The business can see higher fraud losses, lower completion rates, more support contacts, and a gradual erosion of trust in the control itself.

Practitioner Guidance

Governance implication: Treat acceptable friction as a workflow-specific control decision, not a universal policy. The right threshold depends on the abuse profile, the value at risk, and the tolerance for user drop-off in that journey.

What to watch for: A control is probably too heavy when users consistently fail or abandon it for normal reasons, and probably too light when suspicious activity continues with little resistance. The useful boundary is where security uplift remains visible without creating avoidable friction for the intended user base.

Related resources from NHI Mgmt Group

• When does zero trust IAM create more friction than risk reduction?
• How should organisations implement PSD2 controls without adding too much checkout friction?
• How should security teams implement zero trust authentication without adding too much user friction?
• How should security teams replace traditional MFA without creating new access friction?