Protected without noticing: why authentication should start with the customer

Ruby Shipton, Associate Consultant at KAE, discusses how every authentication step walks a fine line between protecting the customer and losing them to checkout drop-off, with 3DS sitting right at the heart of that tension. She also explains what merchants, issuers, and payment providers can do to get the balance right.

Ask consumers about checkout security and they appear to contradict themselves. With 42% extremely or very worried about fraud, almost all of them (93%) say they are willing to accept extra security steps at checkout or login. Yet 87% of online shoppers say they will abandon their cart if checkout is too difficult. Both answers are true. People want to be protected, and they want to be protected without noticing.

That leaves merchants and issuers with a bit of a balancing act. Too little friction lets fraud through and damages trust that is hard to rebuild. Too much drives legitimate customers away, often for good. In the US, wrongly declining genuine customers is estimated to cost merchants far more than card-not-present fraud itself. Every authentication step is a trade-off between protecting a customer and losing them to drop-off.

3D Secure has done a great deal to ease that tension, but technology alone can’t tell a business where friction belongs. Too often, authentication is set by fraud models and compliance rules applied across the board. The businesses getting it right start somewhere else. They start with the customer, in the context of each transaction, and an understanding of how much friction that customer will accept and when.

The cost of getting it wrong, in both directions

Every card-not-present (CNP) transaction requires the customer to be authenticated as the cardholder. Sometimes this happens frictionlessly, with no action needed from the customer. At other times the cardholder is challenged to confirm their identity, for example by entering a one-time passcode, approving the transaction in their banking app, or using biometric verification. Getting the balance between the two wrong is costly either way.

Too little friction leaves accounts open to fraud, and the damage goes beyond lost funds. Fraud severely damages the relationship between customer and merchant: 66% of consumers say they would stop shopping at a retailer where they experienced transaction fraud, often moving to competitors they see as more trustworthy. Merchants also lose merchandise and revenue when fraudulent transactions are reversed through chargebacks.

Too much friction carries an equally real cost, and it is often less visible. If authentication feels time-consuming, difficult or arbitrary, customers abandon their carts. Those who persevere can still be caught by false declines, where a legitimate customer’s transaction is mistakenly flagged as fraudulent, most commonly on first-time or high-value purchases. False declines have a projected cost of USD 118 billion a year to US merchants, far more than CNP fraud itself, which was estimated at above USD 10 billion in 2024. The damage also lasts: 41% of US shoppers never returned to a merchant after having a payment wrongly declined. The result is lost conversions today and lower customer lifetime value tomorrow, as customers buy less or move to competitors with a smoother checkout.

Friction tolerance isn’t fixed

How much friction a customer will accept, their friction tolerance, varies with transaction type, market, demographic, channel, and the device used. Market norms play a significant part. French issuers challenge transactions at twice the rate of other EEA markets, so French cardholders are more accustomed to challenges and likely to tolerate them more readily.

The nature of the transaction matters too. Customers generally accept more friction on purchases they perceive as riskier, such as high-value, first-time, and cross-border transactions. Entersekt found that one in three consumers wanted their bank to use more visible security for infrequent transactions than for routine ones. At the right moment, a challenge can reassure rather than frustrate.

Expectations are also being set outside payments. Amazon’s one-click “Buy now” option lets customers purchase instantly using a saved payment method and delivery address, skipping the basket and checkout entirely. Experiences like this shape what customers expect everywhere, pulling friction tolerance down across every sector.

Understanding friction tolerance is what makes the right balance possible, because it reveals when and how a challenge will be acceptable to the customer facing it.

3DS provides the tools, not the answer

3D Secure, specifically 3DS2, has transformed what is possible. It allows merchants to share more than 100 data points about each transaction with issuers, including billing details and the customer’s purchase history. For most transactions, this context gives issuers enough confidence in the cardholder’s identity to authenticate them without any interaction. According to Mastercard, 90% of 3DS2 transactions happen without the customer needing to do anything.

The benefits run both ways. Customers get frictionless payments without compromising security. Merchants get a common authentication framework across issuers, rather than integrating different processes for each, and liability for most fraudulent transactions shifts to the issuer.

But 3DS does not decide where friction belongs, and the way it is deployed can create friction of its own. Challenge rates vary by issuer and by market, not least because 3DS is mandated in some markets and not others. Two customers buying the same item from the same merchant can have entirely different experiences. In practice, a loyal customer reordering a routine purchase may be asked for a passcode while a first-time buyer making a high-value purchase passes straight through. To the customer, that inconsistency feels arbitrary, and arbitrary friction is the kind most likely to end in an abandoned cart.

Execution matters too. More than half of transactions now take place on mobile, yet merchants frequently rely on browser-based 3DS flows that slow page loading and present challenge screens not properly sized for mobile. Authentication can fail outright, for example if the gateway times out, or the cardholder may simply give up. Either way, friction that was meant to protect the customer ends up losing them.

Starting with the customer

Authentication strategies are often designed around fraud models and compliance requirements, with the customer as an afterthought. Treating authentication as a customer experience decision changes the starting point, but it depends on more than one party. The issuer makes the final call on whether a transaction is challenged and how, while the merchant knows how its customers shop. The right balance comes from bringing the two together.

What merchants can do

Merchants can’t control the issuer’s decision, but they can influence it. Richer 3DS2 data, such as device information, account age, and purchase history, gives issuers the confidence to approve more transactions without a challenge, which is where a loyal customer’s history pays off. In markets with Strong Customer Authentication, such as the UK and EU, merchants can also request exemptions for low-risk transactions, although the issuer can still insist on a challenge and the merchant generally keeps the fraud liability. Merchants also control their own side of the experience, from mobile-optimised authentication flows to tracking challenge and abandonment rates by issuer to see where friction is costing them.

What issuers and payment providers can do

Issuers make the final call, which puts them at the heart of the balance. They also hold a view of the cardholder that no merchant has, from spending patterns to the devices they use and how they prefer to interact with their bank. Combining that understanding with the data merchants share allows issuers to challenge where customers expect it and step back where they don’t, rather than applying blanket rules that feel arbitrary.

The choice of challenge method matters as much as the decision to challenge. Approving a payment with a fingerprint in a banking app is a very different experience from waiting for an SMS passcode, and preferences vary by market, demographic, and device. Issuers that understand their cardholders can match the method to the moment.

Acquirers and payment service providers sit between the two. They can help merchants make the most of the influence they have by advising on exemption strategy, making sure transaction data reaches the issuer complete and accurate, and giving merchants visibility of challenge rates by issuer and market.

Across all of these, expectations will keep rising as passkeys, biometrics, and invisible authentication become the norm elsewhere. Merchants, issuers, and providers that keep researching and testing with their customers will be able to adapt before friction becomes a reason to leave.

Customers have already said they will accept friction that makes sense to them. The task is making sure every check does.

About the author

Ruby Shipton has four years of experience delivering research projects and translating complex data into actionable insight. She manages fieldwork and data analysis across KAE’s research projects, helping clients understand their competitive position, identify opportunities to improve products and services, and strengthen the customer experience.

 

About KAE

KAE helps banks, payment companies, and fintechs around the world make data-backed marketing, product, and strategy decisions by uncovering deep customer, market, and competitor insights. For over 30 years they have provided market-leading businesses with the customer and market intelligence needed to shape and execute go-to-market strategies, develop products and experiences, optimise pricing and communications, and build effective sales and partnership ecosystems.