Friction and Customer Experience Tradeoffs
How to price fraud friction: total cost of fraud, insult rates, the cost of good customers declined or delayed, choosing the cheapest effective action, and governing the friction budget.
Core components
Total cost of fraud
Total cost = fraud losses
+ operational cost (review, investigation, disputes, support contacts)
+ good-customer cost (declined revenue, delay cost, churn, lifetime-value loss)
+ compliance and partner cost (fines, monitoring programs, partner fees)
The objective is to minimize total cost, not losses alone. A control that cuts losses by $100K and costs $300K in good-customer friction is a bad control.
The friction ladder
Choose the lightest action that achieves the needed risk reduction:
| Action | Good-customer cost | Fraud-stopping power | Best for |
|---|---|---|---|
| Invisible (passive scoring, silent monitoring) | None | Detection only | Baseline everywhere |
| Soft friction (warnings, confirmations, payee name check) | Very low | Moderate for scams; low for ATO | Victim-authorized flows (see Payee Confirmation and Payment Friction, Customer Education and Scam Warnings) |
| Step-up (OTP, passkey, biometric re-auth) | Low to moderate | High for ATO if the factor is strong | Risky sessions, account changes, money-out (see Risk-Based Authentication and Step-Up) |
| Delay / hold | Moderate (time cost) | High for reversible-funding fraud | Funding before finality, new payout destinations (see Funds Availability Holds) |
| Limit | Low to moderate | Caps exposure | New accounts, new instruments (see Velocity and Exposure Limits) |
| Manual review | Moderate to high (latency) | High if analysts are good | Ambiguous, high-value cases |
| Decline | High | Complete for that transaction | High-confidence fraud |
| Account action (restrict, close) | Very high | High | Confirmed bad actors |
Measuring good-customer cost
| Measure | Definition | How to get it |
|---|---|---|
| Insult rate / false positive rate | Share of good customers who hit a control | Labels plus holdouts; QA samples of declines (see Fraud QA Program) |
| False positive ratio | Good customers actioned per fraudster actioned | Labels |
| Step-up failure and abandonment | Share of good customers who fail or abandon a challenge | Funnel analytics |
| Hold cost | Value delayed × duration × cost per dollar-day (opportunity cost, complaint risk) | Product analytics |
| Post-friction churn | Retention of customers who hit friction vs matched controls | Experiment or matched cohort analysis |
| Contact rate | Support contacts per 1,000 actioned customers | Support data (see Customer Contact Signals) |
| Complaint rate | Formal complaints, regulator complaints | Complaints data |
Use matched cohorts or experiments to estimate churn impact. Simple before/after comparisons are confounded by everything else going on (see Experimentation and Champion-Challenger).
How to build it
Decline economics: a worked example
Segment-aware friction
The same control has very different costs by segment:
- Tenure. Friction on a 5-year customer with clean history costs far more (high LTV, high trust, low prior risk) than on a 1-day-old account. See Customer Tenure and History.
- Value tier. High-value customers churn harder and complain louder.
- Vulnerability. Older or vulnerable customers may need more protective friction for scams, applied with care. See Elder Financial Exploitation, Trusted Contact and Senior Investor Holds.
- Channel and context. A step-up during a session that's already authenticated with a passkey is cheaper than an SMS OTP after a password login.
Governing the friction budget
- Set a friction budget per money path alongside the loss appetite: maximum insult rate, maximum hold rate, maximum step-up rate. Agree on both with the business owner (see Fraud Operating Model).
- Require friction estimates in every strategy proposal (see Fraud Strategy Lifecycle).
- Review the friction leaders quarterly. These are the rules and models affecting the most good customers (see Rule Governance and Change Management).
- Revisit after attacks. Friction added during an incident should be re-justified once it's over.
- Track friction "debt", the cumulative good-customer impact of all live controls, trended over time.
Who owns what
| Activity | Fraud strategy | Product | CX / Support | Finance | Analytics |
|---|---|---|---|---|---|
| Friction budget | R | A (jointly with exec risk owner) | C | C | C |
| Friction estimates per strategy | A/R | C | C | R | |
| Good-customer cost model | C | C | C | A | R |
| Friction leader review | A/R | C | C | R | |
| Customer messaging for friction | C | A/R | R |
Artifacts and templates
Friction impact statement (for every strategy proposal)
| Field | Value |
|---|---|
| Action type | Decline / hold / step-up / review / limit / warning |
| Good customers affected per month | |
| Segments most affected | |
| Expected step-up pass rate / hold duration | |
| Estimated good-customer cost | |
| Lighter alternative considered | |
| Why the chosen action |
Friction review checklist (quarterly)
- Top 10 friction-generating controls listed, with good-customer counts
- Each one: is a lighter action viable?
- Emergency friction from past incidents removed or re-justified
- Friction by segment: high-tenure, high-value and vulnerable customers
- Complaint and contact themes linked to specific controls
- Holdout results: is friction buying real loss reduction?
Metrics
| Metric | Direction |
|---|---|
| Total cost of fraud (bps of volume) | Down |
| Insult rate by money path and segment | Down at equal or lower loss |
| False positive ratio | Down |
| Step-up abandonment rate | Down |
| Median hold duration and share of value held | Down where loss allows |
| Friction-related contacts and complaints | Down |
| Approval rate on good customers (estimated) | Up |
Pitfalls
- Counting only losses. This is the most common failure, and it produces steadily rising friction.
- Average insult rate hiding a segment problem. 1% overall can be 10% for a valuable segment.
- Assuming step-up is free. SMS OTP failure, delivery delays and abandonment are real costs. Phishing-resistant authenticators lower them (see Passkeys and Phishing-Resistant Authentication).
- Hold creep. Holds introduced for an attack become permanent.
- Detailed decline reasons to customers. Tell customers clearly that a control applied, but keep explanations general so attackers can't learn which signal tripped.
- No counterfactual. Without holdouts you can't prove friction is buying anything.
Related
- Fraud Program Overview · Fraud Metrics and KPIs · Experimentation and Champion-Challenger · Cross-Functional Partnerships
- Risk-Based Authentication and Step-Up · Funds Availability Holds · Velocity and Exposure Limits · Payee Confirmation and Payment Friction
- Neobanks and Consumer Fintech · Retail and Ecommerce · Payments and P2P
Sources and further reading
- GAO-15-593SP Highlights: fraud risk tolerance as an explicit, documented choice rather than zero-fraud
- COSO/ACFE Fraud Risk Management Guide, 2nd ed., Executive Summary (2023): scaling control effort to likelihood and impact
- Abrigo, What SR 26-2 means for financial institutions: the missed-activity vs false-positive trade-off as a model monitoring concern
- CFPB, Regulation E §1005.11: provisional credit and timelines that make some friction (and some fraud) costly in regulated flows