Authentication is part of some of the highest-intent moments in the retail customer journey.
A returning customer has $180 worth of merchandise in their cart. They click checkout, enter the email address tied to their loyalty account, and discover they can't remember their password.
Now they have a choice.
They can reset it — which means waiting for the reset email, creating a new password, then signing in again, hoping their cart is still there. Or they can buy the same products elsewhere.
Retailers spend enormous amounts of time identifying and removing friction throughout the purchase path. Product pages are tested. Checkout fields are removed. Payment options are added. But authentication often escapes that same conversion discipline.
Customers view login, account recovery, and MFA as part of the shopping experience. Unlike employees authenticating into a workforce system, retail customers aren't required to complete the process. If access becomes too difficult, they can leave.
That's why authentication belongs in the conversion funnel and should be evaluated accordingly.
Authentication Friction Hits After Intent Is Already High#
By the time authentication interrupts a purchase, the retailer has already done the hard work of earning the sale. The customer found the product. They considered the price. They added it to their cart. They decided to buy.
Introducing friction at that point puts everything at risk, especially for returning customers who already have a relationship with the retailer. Their account may contain purchase history, saved preferences, loyalty status, or payment information. Forcing them through unnecessary authentication steps can derail a purchase that was already close to completion.
Removing every authentication requirement isn't the answer. Retail accounts are valuable targets, and retailers still need a reliable way to respond when an interaction looks suspicious or when a customer is attempting something with significant consequences.
The better question is where stronger verification actually belongs.
That's the idea behind intelligent MFA. Instead of requiring the same authentication experience for every customer or every interaction, intelligent MFA uses the context surrounding an interaction to determine when additional verification is warranted. Risk signals, familiarity, and the action being attempted can all contribute to that decision.
For retailers, that creates an opportunity to concentrate authentication friction where it provides the most value rather than spreading it across the entire customer journey.
Security Friction Should Have a Reason#
Account takeover is real. Credential stuffing is real. Suspicious activity needs to be stopped before it becomes fraud. But additional verification should have a clear reason for being there.
That decision depends on two things: the level of risk surrounding the interaction and the consequence of the action the customer is attempting. A familiar customer checking an order doesn't call for the same response as a session with several suspicious signals or an attempt to change recovery or payment information.
| Scenario | Potential impact | Suggested response |
|---|---|---|
| Returning customer checks an order from a familiar device | Low | Continue without verification |
| Login attempt from an unfamiliar device with several unusual signals | Higher | Challenge |
| Customer changes recovery email from a familiar session | Higher | Require step-up authentication |
| Sensitive account change during suspicious session | Highest | Require stronger verification |
Intelligent MFA makes that selectivity possible. Rather than applying the strongest verification at the start of every session, retailers can ask for more proof when the risk, the consequence, or both justify it.
The result is a more deliberate approach to friction. A customer completing an ordinary, familiar interaction may move through without interruption. That same customer can still be challenged later if the context changes or they attempt an action that would carry greater consequences if the account were compromised.
Authentication Belongs in the Conversion Conversation#
Decisions about when to challenge a customer, what should trigger additional verification, and how much friction to introduce shouldn't live entirely inside the identity or security team.
Authentication affects more than access. A policy change can alter how many customers complete a purchase, how often they enter recovery, and how much support demand follows. Security and identity teams may understand why a challenge was triggered, while product and digital teams are more likely to see what happened to the customer afterward. Looking at only one side of that experience can hide problems.
A rising challenge rate, for example, doesn't tell you whether the policy is working well. Teams also need to know whether risk increased at the same time and what customers did after they were challenged. If more risky interactions are being stopped while completion and recovery remain steady, the policy may be doing exactly what it should. If challenge rates rise without a corresponding change in risk and more customers abandon or need help, something likely needs to be adjusted.
That's where shared ownership becomes useful. Security and identity teams bring the risk context. Product and digital teams bring visibility into the customer journey. Together, they can see whether authentication is protecting the account without introducing more friction than the situation warrants.
Intelligent MFA gives retailers a way to act on what they learn. Teams can adjust when additional verification is required based on the context of the interaction and continue tuning those decisions as customer behavior and risk change.
That puts authentication into the same optimization process retailers already use elsewhere in the purchase journey: measure what's happening, understand why it's happening, and make changes based on the results.
Protect the Account Without Losing the Customer#
Retailers already scrutinize the moments that lead to a customer completing a purchase. Authentication deserves the same attention because every challenge introduces friction into a journey the customer can choose to abandon. Sometimes that friction is necessary. Sometimes it prevents fraud or adds protection around sensitive account activity. But when every customer receives the same authentication treatment regardless of context, retailers are putting obstacles in front of legitimate customers without gaining equivalent protection.
Intelligent MFA gives retailers a more precise way to decide when additional verification is warranted, allowing it to follow changes in risk and consequence rather than being applied broadly throughout the journey.
For retailers, the goal is to make sure every interruption earns its place in the customer journey.
