How authentication affects conversion

How Authentication Affects Conversion: Protect Revenue Without Adding Unnecessary Friction A customer can want your product, trust your company and have enough money to complete the purchase—and still fail to buy because authentication gets in the way. A forgotten password. A delayed one-time code. A banking application that does not return the customer to checkout. A challenge that times out. A risk system that cannot distinguish a legitimate international customer from a fraudster. Each failure creates a gap between purchase intent and completed revenue. Authentication affects conversion through four closely connected factors: Effort: How much work the customer must perform. Time: How long the customer must wait. Trust: Whether the process feels legitimate, familiar and secure. Decision quality: Whether the system correctly distinguishes legitimate customers from fraudulent activity. Poor authentication increases effort and delay, creates doubt and rejects legitimate users. Effective authentication raises confidence while interrupting as few good customers as possible. The objective is not to eliminate authentication. It is to make authentication nearly invisible when confidence is high—and clear, fast and easy to complete when additional verification is genuinely necessary. Authentication is not just one step

Merchants frequently discuss authentication as though it were a single checkpoint. In practice, a customer may encounter multiple forms of authentication during the same purchase. Account authentication Account authentication determines whether a person should be allowed to access an account. It includes: * Account registration * Password entry * Password recovery * Multifactor authentication * Social or federated login * Passkeys * Device recognition * Step-up verification for sensitive account changes Payment authentication Payment authentication helps determine whether the person using a payment method is its legitimate user. For online card payments, this may involve EMV 3-D Secure, generally called EMV 3DS or 3DS. Authorization Authentication and authorization are not the same. Authentication establishes confidence that the person initiating a transaction is the legitimate user. Authorization is the issuer’s separate decision about whether to approve the payment based on available funds, account status, transaction information, risk signals and other factors. A customer can authenticate successfully and still receive an authorization decline. Likewise, an authentication failure can prevent the transaction from ever reaching a successful authorization. That distinction matters because completed revenue depends on performance throughout the funnel. Completed payments = checkout attempts × account-access completion × payment-authentication completion × authorization approval

Consider an illustrative merchant with 100,000 monthly checkout attempts: * 90% complete the applicable account or identity requirements. * 92% complete payment authentication. * 88% receive authorization approval. That produces 72,864 completed payments. Improving each stage by two percentage points—to 92%, 94% and 90%—produces 77,832 completed payments. That is 4,968 additional payments, or approximately 6.8% relative growth, without acquiring another visitor. This is an illustration rather than an industry benchmark, but it demonstrates an important point: small improvements at several authentication and payment stages can compound into meaningful revenue growth. Authentication optimization is therefore not only a security initiative. It is a revenue-funnel initiative. How authentication friction reduces conversion Forced account creation interrupts buying intent Customers often arrive with one immediate goal: complete the purchase. Mandatory registration changes that goal. The customer must now decide whether to establish an ongoing relationship, provide additional information, create credentials and accept another set of terms before being allowed to pay. Baymard Institute’s 2025 checkout research found that 18% of participants in a survey of 1,026 U.S. adults reported abandoning an order because they did not want to create an account.[1]

That finding does not mean forced registration will reduce every merchant’s conversion by exactly 18%. It does show that mandatory accounts are a meaningful and measurable source of checkout abandonment. Forcing registration may produce more account records. It can also produce fewer paying customers. Password friction can affect both new and returning customers Password friction does not end after registration. Returning customers may: * Forget which email address they used. * Enter several incorrect passwords. * Wait for a reset message. * Switch to an email application. * Discover that the message was filtered as spam. * Create another password. * Lose their original checkout session. * Return to the wrong page after completing the reset. In Baymard usability testing, participants attempting to access private, preexisting accounts at large retail sites experienced an 18.75% average checkout-abandonment rate after an unremembered password led into password-reset email problems.[2] This was a finding from a specific usability-test population, not a universal shopper benchmark. Even with that qualification, it shows why login recovery should be treated as part of the checkout funnel rather than as a separate account-management feature.

FIDO Alliance’s 2024 Online Authentication Barometer provides broader self-reported evidence. In its survey of 10,000 consumers across ten countries, 42% said they had abandoned at least one purchase during the previous month because they could not remember their password.[3] Password problems do not merely create support tickets. They can interrupt revenue at the point of purchase. Every handoff creates another opportunity to lose the customer Not all authentication steps impose the same cost. Confirming with a device biometric may take only a few seconds. Retrieving an email code, changing applications, locating an SMS message or opening a banking application can break the customer’s momentum. The risk becomes particularly visible on mobile devices, where authentication may move the customer among: * The merchant’s application * A mobile browser * An issuer-controlled challenge window * An SMS application * An email application * A mobile banking application Each transition creates the possibility of a broken return path, lost browser state, timeout or customer confusion.

EMVCo has documented lower success in some browser-based out-of-band authentication flows, particularly when a customer leaves a mobile browser to approve the transaction in a banking application. The operating system may place the browser in the background, deactivate the tab or remove it from memory. When the customer returns, the merchant or issuer may not correctly restore the challenge or recognize that authentication was completed.[7] A security process can therefore succeed from the customer’s perspective but still fail technically. Invisible delays create visible abandonment Some authentication friction happens without the customer understanding its cause. The customer only sees: * A spinner that does not stop * A challenge that never loads * A page that suddenly refreshes * An unexplained error * A completed banking-app approval followed by a failed checkout * A payment that appears to be processing indefinitely The technical cause may be a timeout, missing result message, incomplete device information, browser-state loss or another interruption among the participants in the authentication chain. From the customer’s perspective, the distinction rarely matters. The purchase did not work. Authentication can build trust—or damage it Authentication is not always an obstacle.

A familiar, coherent verification step can reassure customers that their account and payment information are being protected. A well-designed biometric confirmation or recognized bank approval can increase confidence at a sensitive moment. The opposite is also true. A sudden redirect to an unfamiliar page, inconsistent branding, poor localization, a broken layout or an outdated-looking challenge can make a legitimate authentication process resemble phishing. Baymard’s checkout research found that 19% of respondents in its 2025 survey had abandoned checkout during the previous three months because they did not trust the site with their credit-card information.[4] That finding concerns payment-interface trust broadly rather than authentication alone. It nevertheless demonstrates why authentication must feel like a coherent part of the payment journey. Security that customers cannot recognize may not create confidence. How authentication can improve conversion Removing every security control would not maximize sustainable revenue. It would expose the merchant to: * Account takeover * Unauthorized transactions * Chargebacks * Fraud losses * Manual-review costs * Customer-support costs * Reputational damage * Tighter issuer or acquirer controls Effective authentication can support conversion by improving the quality of risk decisions.

Rich transaction, customer and device information can help an issuer recognize a legitimate purchase without requiring the customer to complete an additional challenge. When a challenge is needed, the issuer can select an authentication method appropriate for the device and context. EMV 3DS supports the exchange of transaction, payment-method, customer and device information between the merchant side of the transaction and the issuer. The issuer can use this information in its real-time risk assessment and decide whether the transaction can proceed without cardholder interaction or requires a challenge.[5][6] Successful authentication does not guarantee authorization. It can, however, provide a stronger basis for the issuer’s subsequent decision. The best authentication strategy does not ask: How can we challenge more customers? It asks: How can we provide enough trustworthy information to challenge fewer legitimate customers? The two primary EMV 3DS experiences EMV 3DS was developed to support consumer authentication for card-not-present transactions while limiting unnecessary checkout friction. The process generally produces one of two experiences. The frictionless flow In a frictionless flow, the issuer performs a real-time risk assessment using the available transaction, customer and device information. The issuer returns an authentication result without requiring the cardholder to take an additional action. The customer may not see a separate authentication screen at all.

This is what frictionless authentication should mean: the authentication still occurs, but sufficient evidence is available without asking the customer to interrupt the purchase. The challenge flow When the issuer requires additional evidence or cardholder confirmation, it initiates a challenge. The customer may be asked to: * Approve the transaction in a banking application * Enter a one-time code * Confirm through a biometric method * Use a WebAuthn-supported credential * Complete another issuer-supported verification method Challenges may be appropriate because of transaction risk, issuer policy or regulatory requirements. They become a conversion problem when: * Too many low-risk customers are challenged. * The challenge method is unfamiliar. * The customer must change applications repeatedly. * Instructions are unclear. * The process is not localized. * The challenge times out. * The completion result does not return correctly. * The customer completes authentication but cannot resume checkout. EMVCo’s guidance describes the frictionless and challenge flows as complementary parts of a risk-based process rather than opposing approaches.[5] 3DS is not inherently a conversion problem. Poorly implemented, unreliable or indiscriminate 3DS is. Why 3DS authentication fails The issuer receives insufficient or inconsistent information Issuers can only evaluate the information they receive.

A request with limited device information, incomplete customer context or inconsistent transaction data may give the issuer less confidence than a request containing a complete and coherent picture of the purchase. EMVCo describes more than one hundred data elements within the EMV 3DS protocol and emphasizes the value of accurate transaction, customer and device information. For browser transactions, the 3DS Method can allow the issuer’s access-control server to collect additional browser and device data before authentication.[6] Complete information does not guarantee a frictionless result. The issuer controls the authentication decision. It does, however, give the issuer more evidence with which to distinguish a familiar customer from suspicious activity. The strategy treats every transaction the same A returning customer using a recognized device to make a routine purchase should not necessarily receive the same treatment as: * A new customer * A transaction from an unfamiliar device * An unusually large order * A rapid change in account details * An attempt from an unexpected location * Activity associated with account takeover A blanket policy can impose unnecessary friction on trusted customers while still failing to apply sufficient scrutiny where risk is genuinely elevated. Risk-based and step-up authentication use additional verification when the context warrants it rather than making every customer complete the strongest available challenge.

The mobile return journey is unreliable Out-of-band authentication often asks the customer to leave checkout, authenticate through a bank-controlled channel and then return. EMVCo’s browser-based out-of-band guidance identifies several potential failure points: * The customer may not realize that another action is required after returning. * The merchant’s browser tab may refresh or lose state. * The operating system may remove a backgrounded browser from memory. * Authentication may time out. * The issuer may receive the result while the merchant does not. * The customer may approve the transaction but fail to select a final completion button. EMVCo recommends flows that allow the issuer to communicate the result without requiring a final manual “Complete” action where the supported implementation permits it.[7] The mobile return journey should therefore be tested as seriously as the challenge itself. The interface creates doubt Authentication screens are frequently controlled or heavily influenced by the issuer. Merchants may not be able to redesign every element. They can still test whether: * The customer receives clear instructions before leaving checkout. * The expected next step is explained. * The customer knows which application to open. * A visible progress state is shown. * A timeout is communicated. * A retry or fallback path is available. * The customer returns to the correct order state. * Duplicate submissions are prevented.

The customer should never have to guess whether a payment is complete. Regulatory rules are oversimplified Within the European Economic Area, Strong Customer Authentication requirements influence many electronic-payment journeys. The regulatory framework also permits conditional exemptions, including circumstances involving: * Certain low-value remote transactions * Trusted beneficiaries * Qualifying recurring transactions * Transactions identified as low risk through transaction-risk analysis * Certain secure corporate processes These are not universal merchant-controlled bypasses. The applicable payment service provider must satisfy the legal and risk conditions. For recurring transactions, the regulation requires SCA when a series with the same amount and payee is created, amended or initiated for the first time; subsequent transactions within that qualifying series may then be treated differently. Transaction-risk-analysis exemptions also depend on transaction values, fraud-rate thresholds, real-time risk analysis and ongoing monitoring.[10] Authentication strategy must therefore combine conversion optimization with compliant implementation. Nine ways to improve authentication conversion 1. Make guest checkout the easiest first-purchase path Do not require customers to establish an account before they are allowed to pay unless the service genuinely requires an account to be delivered.

Collect the minimum information needed to process the transaction, deliver the product and communicate about the order. After payment, invite the customer to create an account by presenting a clear benefit: * Easier order tracking * Faster future checkout * Saved preferences * Loyalty rewards * Subscription management * Access across devices Account creation after payment converts registration from a barrier into an optional convenience. Guest checkout does not mean abandoning security. Merchants can still evaluate device, transaction and behavioral signals and apply additional verification when risk warrants it. 2. Use passkeys to simplify returning-customer access Passkeys use public-key credentials rather than a shared password. The customer typically authorizes use of the credential through a device PIN, biometric or another local device-unlock method. FIDO Alliance’s 2025 Passkey Index aggregated results from nine member organizations that had deployed passkeys for one to three years. Participants reported: * 93% passkey sign-in success * 63% success for the other authentication methods measured * An average 8.5-second passkey sign-in * An average 31.2-second sign-in for the traditional alternatives measured * An 81% reduction in login-related help-desk incidents

These are results from participating early adopters rather than universal e-commerce benchmarks. The difference between 93% and 63% is also 30 percentage points, not a claim that checkout conversion universally improves by 30%.[8] Most of this evidence concerns account sign-in, not completed purchases. Passkeys can nevertheless remove a substantial login barrier for returning customers who must authenticate before purchasing. Passkey adoption should be paired with well-designed account recovery and fallback methods. A fast primary method can still be undermined by a confusing recovery process. 3. Improve the password fallback rather than making it more complicated Passkeys will not immediately replace every password. Where passwords remain, merchants should avoid arbitrary composition rules that create complexity without proportionate security benefits. NIST SP 800-63B-4 states, within the systems covered by its guidance, that verifiers should not impose mixtures of uppercase letters, lowercase letters, numbers and special characters as mandatory composition rules. It instead emphasizes length, screening against commonly used or compromised passwords, rate limiting, secure storage and support for password managers. NIST’s current minimum-length requirements apply within the scope of its digital-identity guidelines and should not be copied blindly into every commercial environment. The broader design lesson is still valuable:

Do not force customers to create passwords that are hard for humans to use but easy for systems to mishandle. Merchants should support: * Password-manager autofill * Paste functionality * Clear validation before submission * A show-password option * Precise error messages * Secure rate limiting * Blocklists for compromised passwords * Recovery that returns the customer to the original checkout state 4. Apply step-up authentication according to risk Routine, familiar activity should remain simple. Sensitive or unusual actions can require stronger proof. Step-up authentication may be appropriate when a customer: * Signs in from a new device * Changes stored payment information * Adds a new delivery address * Changes account-recovery information * Attempts an unusually large transaction * Shows behavior associated with account takeover * Initiates a high-risk withdrawal, payout or transfer * Changes important account permissions The objective is proportionality. Apply more assurance where the consequences of error are greater, rather than applying maximum friction to every interaction. 5. Send complete and consistent 3DS information The quality of an issuer’s assessment depends partly on the quality of the authentication request. Merchants should work with their payment provider and acquiring partners to ensure that available information is transmitted accurately and consistently, including: * Transaction details * Customer-account history * Billing information * Shipping information * Device characteristics

* Browser information * Prior authentication context * Merchant-risk indicators * Recurring or installment context where applicable For browser-based transactions, merchants should also verify that the 3DS Method and other data-collection components complete as intended when supported. EMVCo notes that rich device and customer information can improve the issuer’s ability to assess risk and may increase frictionless outcomes or authentication success.[6] More data is not automatically better if it is inaccurate, inconsistent or collected without an appropriate legal basis. Data quality, privacy and purpose all matter. 6. Support current EMV 3DS capabilities Merchants should avoid thinking of 3DS only as the older redirect-and-password experience. Current EMV 3DS specifications and guidance support capabilities including: * Browser and application channels * Richer transaction and device data * Frictionless risk assessment * Out-of-band authentication * Biometric and WebAuthn-supported challenges * Secure Payment Confirmation * Decoupled authentication * Recurring and installment transaction information * More flexible application architectures Version support varies across issuers, networks, acquirers and payment providers. Merchants should confirm which features are supported across their most important markets rather than assuming that every participant in the chain supports the same implementation. 7. Design a resilient out-of-band journey

When customers must approve a payment in another application, explain the entire sequence before they leave checkout. A resilient journey should: * Tell the customer which application to open. * Explain that they will need to return. * Keep the checkout state active. * Display an understandable progress indicator. * Prevent duplicate payment submissions. * Recognize the result without unnecessary additional action where supported. * Offer a clear retry or alternative path. * Communicate expiration and timeout states. * Return the customer to the correct order. * Confirm whether the payment succeeded, failed or remains pending. Test this flow under real mobile conditions, including limited memory, backgrounded browsers, slower connections and different operating systems. 8. Localize authentication by market Authentication expectations differ across countries. Customers may be accustomed to: * SMS verification * Mobile banking approvals * National identity applications * Wallet biometrics * Card-issuer applications * QR-based confirmation * Hardware or application-based authenticators Language, device usage, mobile connectivity, issuer technology and regulation all influence whether an authentication method feels familiar or disruptive. Merchants expanding internationally should test authentication by: * Customer country * Card-issuing country * Issuer * Device type * Operating system * Browser * Payment method * Currency * Transaction value * New versus returning customer

A flow that performs well domestically may not perform equally well cross-border. 9. Measure the complete authentication funnel A single payment-conversion percentage cannot identify where authentication is failing. Merchants should separately monitor account access, payment authentication and authorization. Account-access metrics Track: * Registration completion * Guest-checkout usage * Sign-in success * Password-reset initiation and completion * Passkey eligibility, enrollment and usage * Time to authenticate * Recovery failure * Step-up completion Payment-authentication metrics Track: * 3DS eligibility and invocation * Frictionless-flow rate * Challenge rate * Challenge completion * Authentication success * Authentication rejection * Technical errors * Timeouts * Abandonment during challenge * Out-of-band return success Post-authentication metrics Track: * Authorization after successful authentication * Authorization after frictionless authentication * Authorization after a completed challenge * Soft declines * Overall payment conversion * Fraud rate * Chargeback rate * Manual-review rate * False-positive rate Segment these results by market, issuer, device, browser, payment method, transaction value and customer type. The most valuable questions are not merely: “Is 3DS enabled?” “Are we using multifactor authentication?” More useful questions include: * Which legitimate customers are receiving challenges? * Which customers fail or abandon those challenges? * Which issuers produce the most timeouts?

* Which devices struggle to return from banking applications? * How many authenticated transactions are subsequently authorized? * Which authentication policies reduce fraud without reducing completed revenue? * Which markets need a different authentication or payment method? Authentication becomes more complex during global expansion A successful domestic authentication strategy does not automatically become a successful international strategy. Cross-border transactions can present more unfamiliar signals: * The customer’s current location may differ from the card’s issuing country. * The transaction may be presented in a foreign currency. * The customer may be traveling. * The customer may be using an unfamiliar device. * Address formats may differ. * Local phone delivery may be unreliable while the customer is abroad. * The issuer may use a banking application unavailable on the customer’s current device. * Local regulation may require a different authentication treatment. European transactions may be affected by SCA and the conditions governing exemptions. Other markets may have different 3DS adoption levels, issuer practices and preferred verification methods. Authentication is therefore part of the wider global-expansion problem. Merchants need a payment strategy that accounts for: * Local customer behavior * Issuer expectations * Regulatory requirements * Device patterns * Preferred payment methods * Authentication infrastructure * Cross-border risk signals

* The reliability of local and international payment routes The right answer may not always be a different card-authentication flow. In some markets, offering a locally familiar wallet, bank-transfer method or other payment method can avoid card-specific authentication friction entirely.

Authentication should not be treated as an isolated switch. It should be evaluated alongside: * Checkout design * Payment-method coverage * Transaction data * Fraud controls * Issuer behavior * Authorization performance * Customer support * Market localization * Reporting and operational review

For merchants expanding into new markets, the practical objectives are to: * Recognize legitimate customers more accurately. * Apply stronger verification where risk or regulation requires it. * Reduce unnecessary challenges for trusted transactions. * Preserve the customer’s session through authentication. * Offer locally familiar ways to pay. * Identify whether a failed sale was caused by account access, authentication, authorization, checkout design or the selected payment method. * Measure results by market rather than relying only on a global average. Authentication should protect the transaction without becoming the reason the transaction never happens. The best authentication is proportional Security and conversion are not opposing goals. Poor authentication creates friction without necessarily creating better protection. Effective authentication uses data, context and familiar customer experiences to raise confidence with the least necessary interruption. For low-risk customers, authentication should happen quietly whenever possible. For transactions requiring more assurance, it should be clear, fast and easy to complete. For merchants, it should be measurable by market, issuer, device and customer segment. The winning strategy is not simply more authentication or less authentication. It is: The right authentication, for the right customer, at the right moment. That is how authentication stops being a checkout barrier and becomes part of a stronger revenue strategy.

Frequently asked questions Does authentication reduce conversion rates? Authentication can reduce conversion when it adds unnecessary steps, takes too long, creates confusing handoffs or fails legitimate customers. It can support conversion when it prevents fraud, protects customer accounts, improves risk decisions and allows lower-risk transactions to proceed without customer interaction. The commercial outcome depends on how accurately, reliably and proportionately authentication is applied. What is frictionless authentication? Frictionless authentication verifies a customer or transaction using available information without requiring an additional customer action. In an EMV 3DS frictionless flow, the issuer evaluates transaction, customer and device information and returns an authentication result without presenting a challenge to the cardholder.[5] Does 3D Secure lower conversion? 3DS can lower conversion when too many customers receive challenges or when challenges are slow, confusing or unreliable. A well-implemented EMV 3DS flow can support conversion by giving issuers better information, allowing appropriate transactions to proceed frictionlessly and reserving challenges for cases where more assurance is required. What is the difference between authentication and authorization? Authentication establishes confidence that the person initiating a transaction is the legitimate user.

Authorization is the issuer’s separate decision about whether to approve the payment based on factors such as funds, account status, risk and transaction information. Successful authentication does not guarantee authorization. How can merchants reduce 3DS authentication failures? Merchants can improve performance by: * Sending complete and accurate transaction and device information * Supporting current EMV 3DS capabilities * Testing mobile and out-of-band return journeys * Applying risk-based authentication * Managing eligible SCA exemptions correctly with payment partners * Localizing customer instructions * Measuring results by issuer, market and device * Providing clear retry and fallback experiences Do passkeys improve checkout conversion? Evidence currently supports the conclusion that passkeys can improve sign-in speed and sign-in success. FIDO Alliance’s 2025 Passkey Index participants reported 93% passkey sign-in success compared with 63% for the other authentication methods measured. Passkey sign-ins averaged 8.5 seconds versus 31.2 seconds for the alternatives measured.[8] Those findings do not establish a universal percentage improvement in completed-purchase conversion. The likely checkout benefit is indirect: fewer returning customers are blocked by passwords before they can complete their purchase. Are SCA exemptions guaranteed? No.

The EU regulatory framework permits exemptions under specified conditions, but the relevant payment service provider must satisfy the applicable requirements. Issuers or other participants may still require authentication depending on the transaction, risk assessment and regulatory treatment.[10]

[1] Kathryn Reeves, “Checkout UX 2025: 10 Pitfalls and Best Practices,” Baymard Institute, updated November 25, 2025. (Baymard Institute) [2] Edward Scott, “Avoid Unnecessarily Complex Password-Creation Requirements,” Baymard Institute, November 29, 2022. (Baymard Institute) [3] FIDO Alliance, 2024 Online Authentication Barometer, October 2024. The study surveyed 10,000 consumers across the United Kingdom, France, Germany, the United States, Australia, Singapore, Japan, South Korea, India and China. (FIDO Alliance) [4] Baymard Institute, “How Users Perceive Security During the Checkout Flow,” incorporating 2025 survey data. (Baymard Institute) [5] EMVCo, “EMV 3-D Secure” and “Optimising Online Payment Authentication with EMV 3-D Secure,” current technical and implementation guidance. (EMVCo) [6] EMVCo, “Technical Features: Improving Risk Analysis and Frictionless Flow,” EMV 3-D Secure White Paper. (EMVCo) [7] EMVCo, “EMV 3-D Secure: How Merchants and Issuers Can Enhance Browser-Based Out-of-Band Authentication,” February 4, 2026. (EMVCo) [8] FIDO Alliance, Passkey Index 2025, October 2025. The report aggregated data from nine member organizations that had deployed passkeys for one to three years. (FIDO Alliance) [9] National Institute of Standards and Technology, NIST SP 800-63B-4: Digital Identity Guidelines—Authentication and Authenticator Management, August 2025; World Wide Web Consortium, Web Authentication: An API for Accessing Public Key Credentials. (NIST)

[10] European Commission, Commission Delegated Regulation (EU) 2018/389 concerning strong customer authentication and common and secure open standards of communication, consolidated text. (Eur-Lex)

Compact citation block for a LinkedIn article or post LinkedIn posts generally read more naturally with source attribution in the copy—such as “Baymard Institute’s 2025 research found…”—followed by a compact source block:

The revised version below removes all references to payment providers and authentication vendors that could be perceived as competitors. Its external evidence now comes only from: * Original usability research from Baymard Institute * FIDO Alliance research * EMVCo standards and implementation guidance * NIST digital-identity guidance * EU legislation published through EUR-Lex

Fact-check and revision summary Area reviewed What was edited Competitor citations Removed IXOPAY, Novalnet, MojoAuth, NHIMG and other vendor-authored sources from the article. PYMNTS was also removed so the article does not depend on secondary media reporting. AI Overview statistics Removed the claims that every login step reduces conversion by 10%–15%, that 25% abandon when asked to create a password, and that passkeys improve conversion by up to 30%. I could not verify these as broadly applicable, independently supported benchmarks. Forced registration Replaced the supplied 24% figure with Baymard’s current and attributable finding: 18% of participants in its 2025 survey reported abandoning an order because they did not want to create an account. The sample consisted of 1,026 U.S. adults who had shopped online during the previous three months. (Baymard Institute) Password-reset abandonment Qualified the “19%” finding. Baymard observed an 18.75% average abandonment rate among a specific set of usability-test participants who attempted to access private, preexisting accounts and encountered password-reset email problems. It is not a universal abandonment rate for all shoppers. (Baymard Institute) Passkey performance

Changed “30% higher conversion” to “30 percentage points higher sign-in success.” FIDO’s participating organizations reported 93% passkey sign-in success versus 63% for the other methods measured. These were sign-in results from nine early-adopting organizations, not a universal checkout-conversion benchmark. (FIDO Alliance) Passkey speed Retained the 8.5-second versus 31.2-second comparison but added its source population and context. It comes from FIDO’s nine participating organizations and compares passkeys with the other authentication approaches measured in the study. (FIDO Alliance) EMV 3DS versions Removed the fixed recommendation to use “version 2.2 or higher.” EMVCo still notes that 2.2 or higher offers improved SCA functionality, but it currently lists a later specification release. The revised article therefore recommends current, compatible EMV 3DS capabilities rather than hard-coding an aging version number. (EMVCo) SCA exemptions Clarified that exemptions are conditional and generally applied by payment service providers, not unilaterally by merchants. The recurring-transaction provision applies to a series involving the same amount and payee after SCA is applied when the series is created, amended or initiated for the first time. (Eur-Lex) 3DS mobile failures

Replaced vendor commentary with EMVCo’s own guidance. EMVCo documents mobile-browser out-of-band problems involving app switching, timeouts, browser state loss and failures to return authentication results correctly. (EMVCo) Authorization uplift and liability shift Removed the Visa-reported 4% authorization uplift and seven-basis-point fraud statistic. It was a product-specific network result, not an independent merchant benchmark. The article also avoids presenting liability shift as automatic because eligibility depends on scheme rules, transaction status, region and implementation. Password guidance Updated the discussion to reflect NIST SP 800-63B-4. NIST discourages arbitrary character-composition rules while setting longer minimums within the systems covered by its guidance. The article does not present NIST’s federal requirements as a universal e-commerce mandate. (NIST Pages)

Illustrative calculation Verified as correct. The example rises from 72,864 to 77,832 completed payments, an increase of 4,968 payments or approximately 6.8% relative growth. It is now explicitly labeled as an illustration rather than an industry benchmark.

Clean, publication-ready article SEO package SEO title: How Authentication Affects Conversion Rates H1: How Authentication Affects Conversion: Protect Revenue Without Adding Unnecessary Friction Suggested URL: /how-authentication-affects-conversion-rates Primary keyword: how authentication affects conversion Secondary keywords: authentication friction, payment authentication, 3D Secure conversion, 3DS authentication failures, frictionless authentication, checkout conversion, strong customer authentication, passkeys Meta description: Learn how passwords, passkeys, 3D Secure and SCA affect checkout conversion—and how merchants can reduce authentication failures without increasing fraud. Article summary: Authentication can protect a transaction, build customer confidence and improve risk decisions. It can also introduce enough friction to lose a legitimate sale. Here is how merchants can balance security and conversion.

How Authentication Affects Conversion: Turning Security Into a Revenue Advantage A customer can want your product, trust your brand and have enough money to complete the purchase—and still fail to buy because authentication gets in the way. A forgotten password. A delayed one-time passcode. A banking app that never opens. A 3D Secure screen that does not load correctly on mobile. A risk engine that cannot recognize a legitimate customer. Each failure creates a gap between purchase intent and completed revenue. Authentication affects conversion through four forces: Effort: How much work the customer must perform. Time: How long the customer must wait. Trust: Whether the process feels secure and legitimate. Decision quality: Whether the system correctly distinguishes good customers from fraudsters. Poor authentication increases effort and delay, creates doubt and rejects legitimate users. Effective authentication reduces uncertainty without interrupting customers unnecessarily. The objective is not to remove authentication. It is to make authentication nearly invisible when confidence is high—and fast, familiar and easy to complete when additional verification is genuinely needed. Authentication Is Not Just One Step Merchants often talk about authentication as though it were a single checkpoint. In practice, a customer may encounter two separate authentication gates during one purchase.

Account authentication confirms who can access an account. It includes registration, login, password recovery, multifactor authentication, social login and passkeys. Payment authentication confirms that the person using a payment method is its legitimate user. For online card transactions, this frequently involves EMV 3-D Secure, commonly called 3DS. Payment authentication is also different from authorization. Authentication asks whether the person initiating the transaction appears to be the legitimate cardholder. Authorization asks whether the issuer will approve the payment based on factors such as available funds, account status and risk. A customer can authenticate successfully and still receive an authorization decline. (Visa Corporate) This distinction matters because conversion losses can occur at every stage: Completed payments = checkout attempts × account-authentication completion × payment-authentication completion × authorization approval Imagine a merchant with 100,000 monthly checkout attempts: * 90% complete account or identity requirements. * 92% complete payment authentication. * 88% receive issuer authorization. That produces 72,864 completed payments. Improving each stage by only two percentage points—to 92%, 94% and 90%—produces 77,832 completed payments. That is 4,968 additional completed payments, or a 6.8% increase, without acquiring another visitor. Authentication optimization is therefore not an isolated security project. It is a revenue-funnel project.

How Authentication Friction Reduces Conversion Forced accounts interrupt buying intent Customers frequently arrive with one immediate objective: complete the purchase. Requiring them to create an account changes that objective. They must now choose a password, accept additional terms and consider whether they want an ongoing relationship with the merchant. Baymard’s checkout research found that 18% of surveyed shoppers had abandoned an order because they did not want to create an account. Its testing also found that forgotten passwords and problematic reset processes caused nearly 19% checkout abandonment among existing account users attempting to sign in. (Baymard Institute) The problem extends beyond a single checkout. In FIDO Alliance’s ten-country Online Authentication Barometer, 42% of respondents said they had abandoned at least one purchase in the previous month because they could not remember their password. The percentage was even higher among younger consumers. (FIDO Alliance) Forcing registration may produce more accounts in the database, but it can produce fewer customers in the revenue report. Every handoff creates another opportunity to lose the customer Not all authentication steps carry the same conversion cost. Entering a biometric confirmation on the same device may take seconds. Retrieving an email code, switching to a banking application, locating an SMS message or resetting a password can break the customer’s momentum completely.

The cost becomes especially visible on mobile devices. Authentication may require customers to move between a merchant app, browser, inbox, SMS application and banking app. Poorly sized authentication windows, broken deep links, slow-loading issuer pages and incomplete redirects can turn a legitimate security process into a dead end. IXOPAY identifies poor mobile optimization, connectivity problems, mismatched information and configuration issues between issuers, payment providers and access-control servers as common causes of 3DS authentication failure. (IXOPAY) Magic links and one-time codes can be useful alternatives to passwords, but they are not automatically frictionless. Email delivery delays, spam filtering and app switching can reproduce some of the same interruption found in traditional password-reset flows. The right method depends on the customer, device and context. (Baymard Institute) Invisible delays still affect visible conversion Some of the most damaging authentication friction happens in the background. Risk systems may take too long to make a decision. Device and location signals may conflict. The issuer may receive incomplete data. A challenge may time out. An authentication service may be unavailable during a high-volume shopping period. Customers do not need to understand the technical cause. They simply experience a spinning screen, unexplained error or declined payment.

PYMNTS notes that authentication performance depends on the quality of the data shared between merchants and issuers, the accuracy of risk scoring and the resilience of the infrastructure processing the decision. Authentication interruptions during major commerce events can translate immediately into lost transactions. (PYMNTS.com) Security can build trust—or destroy it Authentication is not always an obstacle. A familiar, well-designed verification step can reassure customers that the merchant is protecting their account and payment information. The opposite is also true. A sudden redirect to an unfamiliar domain, an outdated bank page, a layout error or a verification screen in the wrong language can make a legitimate process look like phishing. Baymard found that 19% of surveyed users had abandoned checkout because they did not trust the site with their payment information. Its usability research also shows that seemingly minor layout problems can cause customers to question whether a checkout is secure. (Baymard Institute) Authentication supports conversion when it feels coherent with the rest of the customer journey. Novalnet similarly argues that secure, consistent authentication can strengthen customer confidence, protect payment data and encourage repeat purchasing. (Novalnet) How Authentication Can Increase Conversion

Removing every security check would not maximize revenue. It would expose the merchant to fraud, account takeover, chargebacks and the operational cost of reviewing or reversing bad transactions. Effective authentication can improve conversion in several ways. First, it gives issuers more confidence that a legitimate cardholder is making the purchase. Rich transaction, device and behavioral data can help an issuer approve a genuine customer without requesting additional action. Second, it helps risk systems separate legitimate activity from fraud more accurately. Better decisions can reduce both fraudulent approvals and false declines. Third, successful 3DS authentication may provide fraud-related liability-shift protection in qualifying transactions, subject to the payment network, authentication result, region and applicable scheme rules. Visa reports that clients using authentication solutions such as Visa Secure have, on average, experienced a 4% increase in authorization rates and a seven-basis-point reduction in fraud. These are Visa-reported results rather than a universal merchant benchmark, but they illustrate the commercial value of authentication that improves issuer decision-making rather than merely adding a challenge. (Visa Corporate) The best authentication strategy does not ask, “How can we challenge more customers?” It asks: How can we give the system enough confidence to challenge fewer legitimate customers? The Two 3D Secure Experiences

EMV 3DS was designed to help issuers and merchants reduce card-not-present fraud while preserving a convenient online payment experience. It exchanges transaction, payment-method and device information between the merchant and issuer so the issuer can evaluate whether further verification is necessary. (EMVCo) That evaluation generally produces one of two customer experiences. The frictionless flow In a frictionless flow, the issuer evaluates the available information and authenticates the transaction without asking the customer to take another action. The customer clicks the payment button and continues. The authentication still occurs, but it happens in the background. This is what “frictionless authentication” should mean: sufficient evidence without unnecessary customer interaction. The challenge flow When the issuer requires more evidence, it triggers a challenge. The customer may need to: * Approve the transaction in a banking application. * Enter a one-time passcode. * Confirm with a fingerprint or facial recognition. * Complete another issuer-supported verification method. Challenges are sometimes necessary for regulatory compliance or risk management. They become a conversion problem when low-risk customers are challenged unnecessarily, the experience is poorly designed or the challenge cannot be completed.

EMVCo’s guidance emphasizes that frictionless flows use real-time risk assessment, while challenge flows provide additional assurance when a transaction is considered higher risk or requires confirmation. (EMVCo) 3DS itself is not inherently a conversion killer. Untuned, unreliable or indiscriminate 3DS is. Why 3DS Authentication Fails The issuer receives too little useful information Issuers must make authentication decisions with the information available to them. Missing device data, inconsistent addresses, incomplete customer history or incorrectly formatted transaction information can make an ordinary purchase look uncertain. When the system cannot confidently recognize a legitimate transaction, it may request a challenge or reject the authentication. EMVCo highlights rich data exchange as one of the central ways EMV 3DS supports more accurate issuer decisions. Mastercard also recommends using the EMV 3DS Method URL to collect device and browser information that can help issuers distinguish between transactions that require a challenge and those that can proceed frictionlessly. (EMVCo) The same authentication rule is applied to every customer A returning customer using a recognized device to make a routine purchase should not necessarily receive the same treatment as a first-time customer making an unusually large order from an unfamiliar location.

Blanket authentication policies ignore context. They introduce friction for low-risk customers while potentially failing to apply enough scrutiny to genuinely suspicious behavior. Risk-based and adaptive authentication evaluate signals such as device familiarity, location, transaction value, account history and behavior. Stronger verification is then reserved for actions where the additional assurance is worth the interruption. (Non-Human Identity Management Group) The mobile experience is treated as an afterthought A technically successful authentication request can still fail commercially. A challenge window may not fit the screen. A banking app may not return the customer to checkout. An embedded frame may be blocked. The page may load slowly on a mobile network. The customer may not understand whether the payment is still processing. Responsive verification pages, app-friendly flows, biometric support and reliable handoffs are therefore conversion requirements, not cosmetic enhancements. (IXOPAY) The authentication stack lacks resilience Authentication depends on several participants: the merchant, payment provider, card network, issuer, access-control server and, frequently, the customer’s device or banking application. A failure anywhere in that chain can stop the transaction.

Merchants need visibility into technical errors, timeouts, issuer behavior and challenge completion. Without that observability, authentication failures are often recorded only as generic checkout abandonment or payment declines. (PYMNTS.com) Regulatory rules are applied without optimization In the European Economic Area, Strong Customer Authentication requirements shape many electronic payment journeys. However, the regulatory framework also includes conditional exemptions for circumstances such as qualifying low-value transactions, trusted beneficiaries, certain recurring transactions and transactions identified as low risk through transaction-risk analysis. These exemptions are conditional, and payment service providers or issuers may still require authentication when risk signals justify it. They should therefore be managed as part of a compliant, data-led authentication strategy—not treated as guaranteed ways to bypass security. (Eur-Lex) Eight Ways to Improve Authentication Conversion 1. Make guest checkout the easiest first-purchase path Do not require customers to create an account before they can give you money. Allow the purchase to proceed with the minimum information needed to process and communicate about the order. After payment, offer account creation with a clear benefit such as easier order tracking, saved preferences, loyalty rewards or faster future checkout.

Guest checkout should not mean abandoning identity controls. It can be designed as a governed path that preserves session continuity, protects customer data and allows the customer to transition into an account later. (Baymard Institute) 2. Introduce passkeys for returning customers Passkeys replace shared passwords with cryptographic credentials that are typically unlocked through the customer’s device biometrics or device PIN. FIDO Alliance’s 2025 Passkey Index reported a 93% success rate for passkey sign-ins, compared with 63% for the other authentication methods measured. Passkey sign-ins averaged 8.5 seconds, versus 31.2 seconds for traditional alternatives, and participating organizations reported an 81% reduction in login-related help-desk incidents. (FIDO Alliance) Passkeys are especially useful for repeat customers because they reduce password recall, typing and reset friction. Merchants should still design secure recovery and fallback paths; a strong passkey experience can be undermined if fallback authentication reintroduces weak or confusing processes. 3. Offer authentication choices without overwhelming the customer Social login, passkeys, biometrics, one-time codes and magic links can each remove password friction for certain users. The goal is not to present every possible option. It is to surface the most relevant method for the user’s device and context while maintaining an accessible fallback.

For example, a returning mobile customer with an enrolled passkey can receive a biometric prompt. A new customer can continue as a guest. A customer without passkey support can use a familiar alternative. 4. Apply step-up authentication according to risk Routine, low-risk activity should remain simple. Sensitive or unusual actions can require stronger proof. Step-up authentication may be appropriate when a customer: * Uses a new or high-risk device. * Changes stored payment information. * Modifies an address immediately before a purchase. * Attempts an unusually large transaction. * Shows behavior associated with account takeover or fraud. This approach protects high-risk moments without forcing every customer through the same security ceremony. 5. Send issuers complete, consistent data The quality of the authentication decision depends heavily on the quality of the authentication request. Merchants should work with their payment provider to transmit available transaction, device, browser and customer-context data consistently. They should also verify that optional but valuable data-collection steps—such as the 3DS Method—are completing correctly. Better information does not guarantee a frictionless result, because the issuer controls the ultimate authentication decision. It gives the issuer a stronger basis for recognizing legitimate customers. (EMVCo) 6. Use a modern EMV 3DS implementation

Older authentication experiences were built around browser redirects and static passwords. Newer EMV 3DS versions support mobile applications, richer data exchange, biometrics, out-of-band authentication and more flexible risk-based flows. EMVCo recommends version 2.2 or higher to access optimum functionality for SCA, data sharing and transaction-risk analysis. Version support still depends on the parties involved, so merchants should review compatibility with their payment provider, acquirer and issuer markets. (EMVCo) 7. Localize the authentication experience Authentication expectations differ across markets. Customers may be accustomed to SMS codes in one country, banking-app approvals in another and biometric wallet confirmation elsewhere. Device usage, mobile connectivity, issuer technology and local regulation also influence whether an authentication method feels familiar or frustrating. Localize customer-facing instructions. Preserve the selected language through issuer handoffs wherever possible. Test low-bandwidth conditions. Confirm that deep links and redirects work on locally popular devices and browsers. When expanding internationally, authentication should be tested by country, issuer and payment method—not approved once as a universal global flow. 8. Measure the entire authentication funnel A single “payment conversion” number cannot reveal where authentication is failing. Merchants should monitor:

Account authentication: Registration completion, login success, password-reset frequency, passkey adoption and time to authenticate. Payment authentication: 3DS invocation rate, frictionless rate, challenge rate, challenge completion, authentication success and technical failure rate. Post-authentication performance: Authorization rate after successful authentication, soft declines, overall payment conversion, fraud rate and chargeback rate. These metrics should be segmented by device, browser, country, card-issuing country, issuer, transaction value, new versus returning customer and payment method. Both MojoAuth and IXOPAY recommend instrumenting authentication step by step rather than measuring only the final result. (MojoAuth) The most useful questions are not simply “Is 3DS enabled?” or “Are we using MFA?” They are: * Which legitimate customers are being challenged? * Which customers fail the challenge? * Which issuers produce the most technical failures? * How many authenticated transactions are subsequently authorized? * Which authentication policies reduce fraud without reducing completed revenue? Authentication Becomes More Complex During Global Expansion A flow that performs well in one market may underperform in another.

European transactions may be shaped by SCA requirements and exemption eligibility. Markets with lower 3DS adoption may provide issuers with different volumes and types of authentication data. Some issuers may prefer app-based confirmation, while others still rely heavily on one-time codes. PYMNTS describes this contrast as a difference between highly regulated markets, where excessive challenges can increase abandonment, and less-regulated markets, where insufficient authentication data may make accurate risk decisions harder. (PYMNTS.com) Cross-border transactions also introduce more opportunities for signals to appear inconsistent: * The customer’s location may differ from the card’s issuing country. * The merchant and issuer may use different address conventions. * The transaction may appear in a foreign currency. * The customer may be traveling or using a new device. * SMS or banking-app authentication may not work reliably outside the home market. This makes authentication part of the broader global expansion problem. Merchants need payment infrastructure that can account for local customer behavior, issuer expectations, regulatory requirements and preferred payment methods.

For merchants expanding into new markets, the practical objective is to: * Recognize legitimate customers more accurately. * Apply stronger verification where risk or regulation requires it. * Avoid unnecessary challenges for trusted transactions. * Give customers locally familiar ways to pay and authenticate. * Identify whether a failed sale was caused by login, authentication, authorization or the checkout experience itself. Authentication should protect the transaction without becoming the reason the transaction never happens. Conclusion: The Best Authentication Is Proportional Security and conversion are not opposing goals. Poorly designed authentication creates friction without necessarily improving protection. Properly designed authentication uses data, context and familiar customer experiences to raise confidence with the least possible interruption. For low-risk customers, authentication should happen quietly in the background. For higher-risk transactions, it should be clear, fast and easy to complete. For merchants, it should be measurable by market, issuer, device and customer segment. The winning strategy is not “more authentication” or “less authentication.” It is the right authentication for the right customer at the right moment. That is how authentication stops being a checkout barrier and becomes a revenue advantage.

FAQ Does authentication reduce conversion rates? Authentication can reduce conversion when it adds unnecessary steps, takes too long or fails legitimate customers. It can improve conversion when it reduces fraud, strengthens issuer confidence and allows low-risk transactions to proceed without customer interaction. What is frictionless authentication? Frictionless authentication verifies a customer using available transaction, device and behavioral information without requiring an additional action. In an EMV 3DS frictionless flow, the issuer authenticates the transaction in the background. (EMVCo) Does 3D Secure lower conversion? 3D Secure can lower conversion when too many customers receive challenges or when the challenge experience is slow, confusing or technically unreliable. A well-optimized EMV 3DS implementation can support conversion by allowing lower-risk transactions to proceed frictionlessly and giving issuers better information for their decisions. What is the difference between authentication and authorization? Authentication verifies that the person initiating a transaction appears to be the legitimate user of the payment method. Authorization determines whether the issuer will approve the transaction based on factors such as available funds, account status and risk. (Visa Corporate) How can merchants reduce 3DS authentication failures?

Merchants can improve results by sending complete transaction and device data, using a modern EMV 3DS implementation, optimizing mobile challenge flows, applying risk-based authentication, using eligible SCA exemptions correctly and monitoring performance by issuer, market and device. Do passkeys improve conversion? FIDO Alliance’s Passkey Index found that participating companies achieved a 93% passkey sign-in success rate compared with 63% for the other authentication methods measured. Passkey sign-ins were also substantially faster. Results will vary by implementation and customer population. (FIDO Alliance)

Suggested LinkedIn introduction Authentication is one of the few checkout controls that can either save a sale or kill it. Too little authentication can increase fraud, chargebacks and issuer uncertainty. Too much authentication can send good customers through passwords, codes, redirects and challenges they never complete. The answer is not to choose between security and conversion. It is to build authentication that is proportional to risk: Low-risk customers move quietly. Higher-risk transactions receive stronger verification. Every failure is measured by market, issuer and device. Our latest article explores how login friction, passkeys, 3D Secure, SCA and risk-based authentication influence conversion—and what merchants can do to protect more transactions without losing more customers.

Recommended SEO package SEO title: How Authentication Affects Conversion Rates H1: How Authentication Affects Conversion: Turning Security Into a Revenue Advantage URL slug: /how-authentication-affects-conversion-rates Primary keyword: how authentication affects conversion Secondary keywords: authentication friction, payment authentication, 3D Secure conversion, 3DS authentication failures, frictionless authentication, strong customer authentication, passkeys, checkout conversion rate Meta description: Learn how login friction, passkeys, 3D Secure and risk-based authentication affect conversion—and how merchants can reduce failures without increasing fraud. Article excerpt: Authentication can protect a sale, improve issuer confidence and reduce fraud—or add enough friction to lose the customer. Here is how merchants can build authentication that converts.

Editorial accuracy note The supplied AI Overview’s statements that every additional authentication step reduces conversion by 10%–15% and that 25% of users abandon password creation appear directionally plausible, but they do not trace cleanly to sufficiently transparent primary research as universal benchmarks. This draft instead uses directly attributable Baymard and FIDO Alliance findings and presents vendor-reported performance figures with their source context.