Requiring a second factor at every login can significantly reduce retention
Aliases: every-login MFA · MFA friction · repeated MFA prompt
What it is
Repeated MFA challenge friction is the time, failure, and dependency cost of requiring another authenticator at every login regardless of device, session, or risk change. In frequent-access products or where a second device is inconvenient, it may reduce return and retention; the effect size requires product-specific measurement.
Why it happens
Another factor adds device switching, network wait, code retrieval, unlock, and failure recovery. Cost accumulates with login frequency and concentrates during travel, weak connectivity, shared-device use, assistive technology, and brief repeated tasks. Users may retain sessions, share accounts, or choose weaker channels. More challenges do not linearly add security when low-risk sessions repeatedly prove unchanged state.
Studying it
Use randomized or quasi-experimental comparison of every-login, trusted-session, and risk-triggered policies. Track login and task completion, return, churn, support, and takeover, stratified by frequency, device access, and ability over several weeks. One login's duration is not retention. Preserve security guardrails and do not expose high-risk accounts to a weak condition.
Where it stops holding
High-value, shared-terminal, or high-threat environments may justify every-session verification when security benefit exceeds retention cost. Convenient login cannot mean indefinite sessions. “Significant” is a product hypothesis, not a law that every user leaves; security and equity outcomes must accompany retention.
Applying it
- Bind challenge to risk and session state and retain reauthentication for high-impact actions rather than escalating every ordinary visit.
- Support fast, phishing-resistant, accessible authenticators with clear failure recovery to reduce code retrieval and device switching.
- Monitor challenge exits, alternate-channel use, sharing, and attack outcomes with both security and retention guardrails.
- Explain an unavoidable per-session policy in advance and optimize its path instead of silently adding steps.