--- url: 'https://www.corbado.com/blog/login-friction-kills-conversion' title: 'Login Friction kills Conversion: 5 Symptoms & Fixes ' description: 'Login friction silently kills conversion. Learn the 5 authentication symptoms that cause drop-off and how to diagnose them with the right metrics.' lang: 'en' author: 'Vincent Delitz' date: '2025-12-22T14:21:13.556Z' lastModified: '2026-08-28T12:00:44.307Z' keywords: 'login friction, login conversion rate, login conversion, authentication friction, login abandonment, checkout abandonment' category: 'Authentication' --- # Login Friction kills Conversion: 5 Symptoms & Fixes ## Key Facts - **Login friction** causes measurable revenue loss: cart abandonment averages 70% and 19% of users abandon specifically because they forgot their password. - A **password reset rate** above 10% of total login attempts directly signals password fatigue is hurting login conversion rate, representing frustrated users who cannot log in. - **Passkeys achieve 93% login success** versus 63% for passwords, eliminating password fatigue, OTP delivery failures and security-induced friction simultaneously. - **Mobile conversion rates** (approximately 2%) lag desktop (approximately 3%) despite mobile driving 75% of visits, largely due to cross-device authentication friction. - **Forrester estimates USD 70 per password reset** requiring human intervention; at enterprise scale this runs into millions annually, excluding lost conversion revenue. ## 1. Introduction: Why 'we have a conversion problem' is often login friction If you're a product manager responsible for authentication, you've likely heard: "Why is our [conversion rate](https://www.corbado.com/blog/logins-impact-checkout-conversion) stuck?" The usual suspects get blamed: ad spend, page load times, [checkout UX](https://www.corbado.com/faq/redirect-based-passkeys-preference). But there's a step in the funnel that's harder to diagnose: the login. Most analytics stacks treat authentication as binary: logged in or not. They don't capture the **authentication friction** in between: the user who tried three passwords and bounced, the one whose SMS code arrived 45 seconds too late, the returning customer who couldn't remember if they used "Sign in with Google" or created a password. This blind spot is expensive. [Cart abandonment rates average around 70%](https://baymard.com/lists/cart-abandonment-rate) and a significant chunk traces back to **login friction**. Unlike checkout abandonment (which every [e-commerce](https://www.corbado.com/passkeys-for-e-commerce) team obsesses over), **login failures** go unmeasured and unfixed. The impact compounds: every failed login is wasted CAC, reduced CLTV and a customer who may switch to a competitor offering **frictionless login**. If you can't instrument it, you can't improve it. ### 1.1 Authentication Business Case: What's your Number? Before diving deeper, consider this: **If reducing login drop-off by a few percent means +6 figures in annual revenue** for a large [e-commerce](https://www.corbado.com/passkeys-for-e-commerce) company, what does it mean for yours? If that data does not exist in your analytics stack, you have identified the first symptom of a deeper problem: you are flying blind on authentication. ### 1.2 Login Tax: Where your Funnel actually leaks Every authentication step is a tax on user intent. The question is: do you know how much you're charging? Consider what happens when a returning user wants to complete a purchase: 1. They try their usual password. Wrong. 2. They try a variation. Wrong again. 3. Now they're at a decision point: reset password (5+ minutes of friction) or abandon cart (2 seconds). For most users, abandonment wins. And your analytics just shows a bounce, not the root cause. This "login tax" compounds at the worst possible moment: checkout. The user has already invested time browsing, comparing, adding to cart. They're ready to pay. Then authentication friction hits and cognitive load exceeds motivation. ```mermaid graph TD A[Returning User at Checkout] --> B{Try usual password}; B -- Failed --> C{Try password variation}; C -- Failed --> D[High Friction Decision Point]; D -- Path of least resistance --> E["Abandon Cart (2 seconds)"]; D -- Path of most resistance --> F["Initiate Password Reset (5+ minutes)"]; F --> G{Reset Successful?}; G -- No --> E; G -- Yes --> H[Return to Checkout & Login]; style E fill:#ffcccc,stroke:#ff0000,stroke-width:2px,color:#990000 style D fill:#fff4e6,stroke:#ff9900,stroke-width:2px ``` **What this article covers:** This article is a practical breakdown of the five authentication failures that kill conversion and how to diagnose them in your own funnel. Each section includes what to measure, what the root cause typically is and what the fix looks like. The goal is to give you the data to build a [business case](https://www.corbado.com/blog/passkey-adoption-business-case) for authentication investment and a roadmap to actually execute it. ![authentication funnel conversion rates](https://s3.eu-central-1.amazonaws.com/corbado-cloud-staging-website-assets/authentication_funnel_conversion_rates_01b050f447.png) ## 2. Symptom 1: Users abandon at Login or Sign-up **How to detect it:** Track the delta between `login_modal_opened` and `login_successful`. If you're seeing +20% drop-off before authentication completes, this section applies to you. **Why it matters:** This is the highest-intent moment in your funnel. Users who reach login have already decided to engage: they're one step from conversion. Losing them here has the worst ROI impact of any funnel stage. This video shows how to pinpoint where users abandon login inside the funnel: [Watch on YouTube](https://www.youtube.com/watch?v=n_ztfoPszsM) ### 2.1 Forced Account Creation kills Sign-up Conversion Rate The "forced registration" pattern is an aggressive conversion killer. At checkout, users have invested time browsing and comparing. Forcing account creation at the exact moment they want to pay creates **maximum friction at maximum intent**. Passkeys can help solve this - see how [passkeys increase conversion](https://www.corbado.com/blog/passkeys-increase-conversion) by achieving 93% login success vs 63% for passwords. For detailed analysis of [guest checkout](https://www.corbado.com/blog/guest-checkout-vs-forced-login) vs [forced login](https://www.corbado.com/blog/guest-checkout-vs-forced-login), see our dedicated article. ### 2.2 Social Login Implementation Failures [Social login](https://www.corbado.com/glossary/social-login) (e.g. "Sign in with Google," "Continue with Apple") theoretically reduces friction. But poor implementation creates new **login problems**: If these buttons are hidden below the fold, rendered in a way that suggests they are secondary or inferior options or if they lack the appropriate "scopes" (asking for too much data), the user is funneled back into the high-friction password path. Furthermore, the "NASCAR effect", where a screen is cluttered with logos of every possible identity provider (Google, [Facebook](https://www.corbado.com/blog/facebook-passkeys), Apple, etc.), can lead to decision paralysis. Conversely, offering only one option that the user doesn't utilize (e.g. offering only [Facebook](https://www.corbado.com/blog/facebook-passkeys) login when your customers primarily use Apple devices) creates a dead end. The design choice often stems from a misguided desire to "own the credential" (forcing a local password), which inadvertently increases abandonment by pushing users toward the path of most resistance. #### 2.1.3 Mobile Account Creation can be a Nightmare On mobile devices, where screen space is limited and typing is prone to error, the [forced login](https://www.corbado.com/blog/guest-checkout-vs-forced-login) wall is even more deadly. Filling out a multi-field registration form on a smartphone keyboard is a high-friction activity. If the "Sign Up" button is not easily accessible via a "[One-Tap](https://docs.corbado.com/corbado-connect/features/one-tap-login)" solution or if the form does not support autofill attributes correctly, the abandonment rate spikes significantly compared to desktop. The gap between [mobile traffic (high) and mobile conversion (low)](https://redstagfulfillment.com/what-percentage-of-ecommerce-sales-on-mobile-devices/) is often explained by the sheer difficulty of navigating these login walls on a 6-inch screen. ## 3. Symptom 2: Password Fatigue and constant Resets **How to detect it:** [Password reset](https://www.corbado.com/blog/password-reset-increase-customer-retention) rate as % of total login attempts. A number above 10% means that password fatigue is hurting **login conversion rate**. **Why it matters:** [Password resets](https://www.corbado.com/faq/passkeys-reduce-password-resets-otp-costs) proxy frustrated users. Every reset means a user who wanted to engage but **can't log in**. ### 3.1 Password Reset Rate: The Frustration Index The **password reset rate** measures **authentication friction** directly. When returning users see "Incorrect Password," they try variations. If those fail: initiate password reset or abandon. #### 3.1.1 Password Reset Funnel Drop-offs ```mermaid graph LR Step1(1. Click 'Forgot Password') --> Step2(2. Enter Email); Step2 --> Step3{3. Wait for Email \n Latency Variable}; Step3 --Arrives late--> DropOff1[Drop-off: Distracted/Impatient]; Step3 --Arrives--> Step4(4. Switch Context to Email App); Step4 --> Step5{5. Find Email \n Spam/Promotions?}; Step5 --Buried--> DropOff2[Drop-off: Can't find email]; Step5 --Found--> Step6(6. Click Reset Link); Step6 --> Step7{7. Create New Password \n Complexity Rules}; Step7 --Fails rules/History check--> DropOff3[Drop-off: Frustration/Rage Quit]; Step7 --Success--> Step8(8. Confirm Password); Step8 --> Step9(9. Return to Login Screen); Step9 --> Step10(10. Enter New Credentials); Step10 --> Success(Back to Checkout); style DropOff1 fill:#ffdede,stroke:none,color:#cc0000 style DropOff2 fill:#ffdede,stroke:none,color:#cc0000 style DropOff3 fill:#ffdede,stroke:none,color:#cc0000 linkStyle 2,5,8 stroke:#cc0000,stroke-width:2px,stroke-dasharray: 5 5; ``` [\~19% of users abandon carts](https://www.elavon.co.uk/insights/news/cart-abandonment-problems.html) because they forgot their password. Each step is a drop-off point. By step 5 (finding the email in spam), you've lost a significant chunk of users. #### 3.1.2 History Check Blockade [Nearly 50% of users would abandon](https://www.darkreading.com/cyber-risk/nearly-50-of-people-will-abandon-sites-prohibiting-password-reuse) if told their new password can't be the same as an old one. This "history check" blocks the user's coping mechanism for password fatigue: reuse. Without a **low friction authentication** alternative (like passkeys), users invent passwords on the fly that they'll forget, ensuring the cycle repeats. #### 3.1.3 Operational Costs of Password Resets [Forrester estimates $70 per password reset](https://www.forbes.com/councils/forbestechcouncil/2023/03/23/embracing-the-end-of-the-password-here-and-now/) requiring human intervention. For large enterprises, this runs into millions annually. The invisible cost is worse: frustrated returning users who wanted to engage but were locked out. The [password reset](https://www.corbado.com/blog/password-reset-increase-customer-retention) loop is a self-inflicted wound on conversion. #### 3.1.4 Security-Friction Paradox Ironically, the friction of passwords leads to weaker security. Because users are frustrated, they resort to dangerous behaviors: writing passwords down, using "Password123" or sharing credentials. [46% of US consumers fail to complete transactions due to authentication failure](https://www.ponemon.org/local/upload/file/NokNokWP_FINAL_3.pdf) and this failure drives them toward competitors who might offer a seamless login experience. The password has become the primary vector for both security breaches (via [credential stuffing](https://www.corbado.com/glossary/credential-stuffing)) and conversion breaches (via abandonment). ## 4. Symptom 3: OTP and SMS Login Problems **How to detect it:** Track the process of OTP request, OTP submission and OTP success. If the time-to-submit is >30 seconds or if you have a >5% failure rate, then SMS OTPs have a conversion problem. **Why it matters:** SMS OTPs swap a memory problem for a delivery problem. The failure modes are invisible: you see drop-off, not the user staring at their phone waiting for a code that never arrives. Worse: SMS costs scale with usage, so you're paying for **authentication friction**. ### 4.1 Why Users can't log in: SMS Delivery Failures The fundamental flaw of [SMS authentication](https://www.corbado.com/blog/sms-costs) is reliance on the telephony network (SS7) which was never designed for real-time authentication. Delivery depends on aggregators, carriers and roaming agreements. One failure means a user is staring at a screen, waiting for a code that never arrives. #### 4.1.1 Carrier Filtering and Pump Fraud SMS pumping fraud has triggered aggressive carrier spam filtering. Legitimate OTPs get caught, especially for international users. A German user signing up for a US service may never receive the code. #### 4.1.2 Mobile OTP Context Switching SMS OTPs force users to leave the checkout flow, open Messages, memorize the code and switch back. On aggressive memory-management systems, this reload resets the checkout entirely, [clearing form data](https://www.mobiloud.com/blog/cart-abandonment-statistics). While "Auto-fill OTP" on [iOS](https://www.corbado.com/blog/webauthn-errors) and [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) helps, it often fails if SMS format doesn't match OS heuristics. ## 5. Symptom 4: Cross-Device Login Friction and Session Timeouts **How to detect it:** Compare [conversion rates](https://www.corbado.com/blog/logins-impact-checkout-conversion) by device type. Mobile traffic 70%+ but conversion lags desktop by 30%+ could mean that there is some cross-device **authentication friction**. Also check the session timeout rates at checkout. **Why it matters:** Users browse on mobile, but often buy on desktop. If authentication state doesn't transfer, you're forcing re-login at the worst moment. Aggressive session timeouts (set by security/compliance) kill conversions mid-checkout or in between two visits. ![cross device authentication air gap](https://s3.eu-central-1.amazonaws.com/corbado-cloud-staging-website-assets/cross_device_authentication_air_gap_2052925643.png) ### 5.1 Cross-Device Authentication Gap The **"cross-device gap"** is a well-documented phenomenon in [e-commerce](https://www.corbado.com/passkeys-for-e-commerce). Mobile traffic accounts for approximately [75% of visits, yet mobile conversion rates (approx 2%) lag significantly behind desktop conversion rates (approx 3%)](https://redstagfulfillment.com/what-percentage-of-ecommerce-sales-on-mobile-devices/). While screen size plays a role, a significant contributor to this gap is the inability to seamlessly transfer authentication state. #### 6.1.1 Why Users can't log in after Device Switch Consider a common scenario: A user on a smartphone clicks an ad, browses a store and adds items to a cart. They are "guest" browsing. They decide to finish the purchase on their laptop where it's easier to type credit card details. When they open the site on the desktop, their cart is empty. To retrieve it, they must log in. However, if they create an account on mobile, they might have used a "Suggest Password" feature that created a complex string they never saw. Now, on their Windows desktop, they don't know the password. They are effectively locked out of their own intent. They must initiate a [password reset](https://www.corbado.com/blog/password-reset-increase-customer-retention) on the desktop, which sends an email to their phone, forcing a cumbersome loop of device switching that often results in abandonment. The friction of bridging the air gap between mobile and desktop is too high. #### 6.1.2 Session timeouts set by security, felt by conversion Session timeouts often get set by security/compliance teams (PCI-DSS, etc.) without input from product. A 15-minute timeout sounds reasonable until you realize "inactivity" to a server is "looking for a coupon code" or "checking a competitor's price" to a user. #### 6.1.3 Timeout Abandonment at Checkout This happens after the user committed. The rejection feels punitive. Without auto-save of form data, they must re-enter everything. [60% of consumers cite login frustration](https://press.pingidentity.com/2023-10-24-Ping-Identity-Survey-Finds-Easy-Digital-Experiences-Are-New-Barometer-for-Customer-Loyalty) (including timeouts) as reason for abandoning entirely. ## 6. Symptom 5: Reactive Security Measures that hurt UX **How to detect it:** Check if MFA step-up rates spiked after a security incident. Look for sudden increases in "suspicious activity" blocks that correlate with conversion drops. Survey customer support for "I can't log in" ticket volume. **Why it matters:** Security and product teams often operate in silos. After a credential stuffing attack or compliance audit, security adds friction (e.g. mandatory MFA, aggressive risk scoring) without visibility into conversion impact. The result: fraud drops, but so does revenue. The goal is to find methods (like passkeys) that are both more secure and less friction. ## 7. Debugging "Can't Log In" Reports When users report "I **can't log in**," how long does diagnosis take? If you lack authentication instrumentation, you're flying blind. ### 7.1 Classify the Login Failure Type | If logs show\... | It's probably... | Action | | ---------------------------------------- | ----------------------- | --------------------------------------- | | No events at all | User never reached auth | Check upstream funnel | | Auth initiated, no method selected | UI confusion | UX audit of login screen | | Method selected, error before completion | Technical failure | Debug by error type | | NotAllowedError | User cancelled prompt | UX audit—understand why users cancel | | ServerError | Backend issue | Check API logs and infrastructure | | Success but user reports "can't log in" | Session/cookie issue | Check device, browser, privacy settings | ### 7.2 Segment Login Conversion Rate by Dimension A 90% success rate might mask 50% failure for mobile users. Slice by: - **Device/browser:** Chrome on [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) failing while Safari on [iOS](https://www.corbado.com/blog/webauthn-errors) succeeds indicates a specific bug. - **Auth method:** If password has 90% success but [social login](https://www.corbado.com/glossary/social-login) has 60%, focus on the [social login](https://www.corbado.com/glossary/social-login) implementation. - **Entry touchpoint:** If header login has 95% success but checkout login has 70%, the checkout flow has unique friction. - **New vs. returning:** New users failing suggests registration issues; returning users failing suggests password/session problems. - **Region/market:** Social login preferences vary dramatically (Facebook strong in US, Kakao/Naver in Korea, Google dominant in Europe). SMS delivery reliability also varies by carrier and country. ### 7.3 Key Authentication Metrics For comprehensive measurement, see our [authentication analytics](https://www.corbado.com/blog/authentication-analytics-playbook) playbook. ## 8. Practical Steps toward Frictionless Login You don't need to rip out your identity provider (Auth0, [Cognito](https://www.corbado.com/blog/passkeys-amazon-cognito), ForgeRock, Ping) to improve. High-impact UX fixes can be shipped in a single sprint. ### 8.1 Quick Wins to reduce Login Friction - **Unmask Password:** "Show Password" (eye icon) reduces typo-based **login failures** on mobile - **Persistent Login Options:** If user previously used Google, highlight the Google button. "You last used Google" badge reduces cognitive load - **Inline Validation:** Validate password requirements in real-time, not on submit - **Extend Sessions:** Only time out for sensitive actions, not product browsing - **Auto-Focus:** Cursor in email field on modal open, correct keyboard on mobile ### 8.2 Passkeys: The Path to Frictionless Authentication UX tweaks help, but the biggest lever is removing the password entirely. **Passkeys** solve Symptoms 1, 2, 3 and 5: - **Zero typing:** [Face ID](https://www.corbado.com/faq/is-face-id-passkey)/Touch ID/[Windows Hello](https://www.corbado.com/glossary/windows-hello) - no password to misremember - **No delivery delays:** No SMS code. Credential lives on device - **No resets:** Can't forget a passkey. Syncs via [iCloud Keychain](https://www.corbado.com/glossary/icloud-keychain) or [Google Password Manager](https://www.corbado.com/blog/how-to-use-google-password-manager) - **Better security:** [Phishing](https://www.corbado.com/glossary/phishing)-resistant by design - stronger authentication without friction ## 9. How Corbado can help Can you answer these about your authentication? - Which device/browser combinations have highest drop-off? - What share of logins fail technically versus user-cancelled, broken down by method (password, social, OTP, passkey)? - When users report "I **can't log in**," how long does it take you to see what actually happened to them? - How does **login conversion rate** differ: header login versus checkout login? If not, you have the same blind spot most teams have. [Corbado Observe](https://www.corbado.com/observe) was built for these four questions specifically, and it runs without changing the authentication stack underneath it. [Video: Login funnel](https://www.corbado.com/videos/login-funnel.mp4) ([See Login Funnel in Corbado Observe](https://www.corbado.com/observe/login-funnel)) ### 9.1 Authentication Funnel Telemetry - **Funnel:** the login ceremony as stages with the drop-off between them, modelled as one process across passkey, password, OTP, social and fallback - **Subflow Explorer:** the same ceremony counted subflow by subflow, each with its total, its completion rate, its error rate and how long it takes at the median and at the 90th percentile, which is what tells a slow path apart from a broken one - **Device Health:** OS, OS version and device model ranked by completion rate, with a count of identified users who hit an error ceremony on each, so [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) Chrome and [iOS](https://www.corbado.com/blog/webauthn-errors) Safari stop hiding inside one average - **Passkey Errors:** failed ceremonies grouped by cause, where a group is keyed on subflow type, step name, error name, message, code and duration bucket, which turns vague **login problems** into something you can assign to someone ### 9.2 Login Conversion Rate Optimization (CRO) - **Login Methods:** passkey, password and social side by side, three rows and no more, each with its own volume share, completion rate, error rate and duration. OTP sits one level down as its own subflow rather than as a fourth row here. See [passkey analytics](https://www.corbado.com/blog/passkey-analytics) for passkey-specific KPIs - **Method Uplift:** each flow classified by which methods were reachable in it (password only, password and passkey, password and social, all three), measured against the password-only baseline - **Experiments:** variants you tag yourself with the reserved `experiment_` prefix, evaluated per run. Observe reads the test, your own tooling runs it - **Touchpoints and Markets:** the same [conversion rates](https://www.corbado.com/blog/logins-impact-checkout-conversion) and [cart abandonment](https://www.corbado.com/blog/ecommerce-authentication) picture, split by where in the journey the login sits and by region - **Annotations:** dated notes on the project, so the Black Friday release that moved the numbers is written down beside the date picker ### 9.3 From Diagnosis to Frictionless Login Once Touchpoints shows checkout login completing below header login, [Corbado Connect](https://www.corbado.com/connect) is the part that changes it: - **Passkey Intelligence:** decides whether to offer a passkey at all before the ceremony starts, reading a detection object that already knows which credentials this account and this environment hold and what happened here last time, recent aborted appends and incomplete passkey logins included - **Gradual rollout rulesets:** conditions on client information (platform, platform version, browser, device model, IP containment, feature flags) with allow, block, sampling and split-group actions. A ruleset can be replayed over the last seven days of recorded traffic first, so the checkout cohort it would catch has a size before a single customer sees it - **Passkey list component:** shows the user which credential is which, with provider name and icon, the browser and OS it was created with, when it was last used, plus a Synced or Hybrid tag Every login that finishes on a passkey is one your SMS provider does not invoice, which is worth carrying into the same conversation, though it is an outcome of the rollout rather than a capability of it. For the measurement side, see [authentication observability](https://www.corbado.com/blog/authentication-observability). ## 10. Conclusion: Fixing Login Friction to improve Conversion **Login friction** is a revenue problem hiding in a metrics blind spot. The five symptoms are identifiable and fixable: 1. **Login/sign-up abandonment**: Add [guest checkout](https://www.corbado.com/blog/guest-checkout-vs-forced-login), prominent social login, fix mobile UX 2. **Password fatigue**: Track reset rates, implement passkey append flows 3. **OTP delivery failures**: Measure success rates by region/carrier, consider alternatives 4. **Cross-device friction**: Extend sessions, preserve cart state, improve handover UX 5. **Security-induced friction**: Align security and product on shared conversion metrics **The meta-problem:** Most organizations can't see **authentication friction** in their analytics. Bounces get logged; root causes don't. **The path to frictionless login:** 1. Instrument the auth funnel (see [authentication analytics](https://www.corbado.com/blog/authentication-analytics-playbook) playbook) 2. Segment **login conversion rate** by device, method, touchpoint 3. Fix highest-impact issues first (often UX changes in one sprint) 4. Build the [business case](https://www.corbado.com/blog/passkey-adoption-business-case) for low-friction auth 5. Analyze your complete [e-commerce funnel](https://www.corbado.com/blog/ecommerce-funnel-analysis) to understand how authentication fits into the broader checkout journey Authentication is the one step every user must complete. Optimizing it is the highest-leverage conversion work most teams aren't doing. ## Frequently Asked Questions ### How do I measure authentication drop-off in my conversion funnel? Track discrete events from login_initiated to session_established, segmented by auth method, device type and entry touchpoint. A 90% aggregate success rate can mask a 50% failure rate for specific segments such as mobile users. Segment by new versus returning users to distinguish registration problems from session and password issues. ### What is the NASCAR effect in social login and why does it hurt checkout conversion? The NASCAR effect occurs when a login screen is cluttered with logos from multiple identity providers, creating decision paralysis at the highest-intent moment in the funnel. The fix is surfacing one prominent primary option with a secondary 'More options' link rather than displaying all providers simultaneously. Offering only one provider that users do not recognize creates an equally damaging dead end. ### Why do session timeouts set by security teams hurt checkout conversion rates? Session timeouts are typically set by security or compliance teams without product input. A 15-minute timeout registers as server inactivity while the user checks coupon codes or compares prices on another tab. 60% of consumers cite login frustration including timeouts as a reason for abandoning entirely, and without form auto-save users must re-enter all checkout data. ### What are the hidden conversion costs of password resets beyond direct operational expenses? The larger impact is conversion loss: 46% of US consumers fail to complete transactions due to authentication failure, often switching to competitors. The password reset funnel contains multiple drop-off points including email delivery latency, spam filtering and password complexity rules, each losing a portion of originally high-intent users before they return to checkout. ### Why does the password history check during resets cause checkout abandonment? Nearly 50% of users would abandon a site if told their new password cannot match a previous one. The history check blocks the primary coping mechanism for password fatigue: reusing a familiar credential. Without a low-friction alternative, users create on-the-fly passwords they immediately forget, restarting the full abandonment cycle on their next visit.