Somebody in your company paid for every returning customer. A win-back email or a retargeting ad sits behind that visit, and marketing can tell you what it cost down to the click. Then the customer taps "Sign in," and a visitor you've already paid for meets a password field that nobody in marketing owns.
I've spent fifteen years running identity programs, and my view on this is blunt. Customer identity is a growth function that most companies still run as a security control. The sign-in page gets designed to keep the wrong people out, and whether it lets the right people in quickly ends up as somebody else's problem. Usually it isn't anyone's metric at all.
The step nobody owns
Follow a failed return visit through your systems. The analytics platform records a session that ended on the sign-in page. The identity platform records a failed authentication. If the customer tried to recover the account, the support desk records a reset request, and if they gave up halfway through, nothing records anything. Each team holds a fragment, and none of the fragments is labeled "lost customer."
Put the fragments together and the picture is hard to ignore. In April 2026 the FIDO Alliance surveyed 11,000 adults in ten countries, and 47% said they were likely to abandon a purchase or sign-in when they couldn't remember a password. Among US respondents the figure was 51%.
The Thales 2026 Digital Trust Index, based on 14,300 consumers in 13 countries, found that 57% had problems accessing a website in the past year. When access felt too slow or intrusive, 33% said they switched to a competitor or abandoned the attempt. Another 36% said they delayed or looked for a different channel.
Answers about future behavior deserve some skepticism, since plenty of people who say they'll leave end up resetting the password anyway. Even with a generous discount, a third of customers naming a bad sign-in as a reason to try a competitor describes a churn driver. Churn drivers normally get an owner and a slot in the quarterly business review.
The sign-in screen rarely gets either, and I think the cause is organizational. Security owns the control and product owns the page, while marketing owns the relationship the page is supposed to continue. The one moment where all three meet has the least shared measurement of anything in the funnel.
Frictionless is the wrong goal
Customer identity has been framed for years as a trade between security and convenience, with "frictionless" held up as the prize. I think that framing has done real damage. It treats every step as a pure cost, so teams remove checks until the fraud team pushes back, then add them again after an incident.
Customers don't think about it that way. In the Thales survey, 45% said they prefer stronger security checks even if sign-up takes longer, compared with 22% who would take faster access with lighter protection. Asked about specific safeguards, 69% said multifactor authentication increases their trust in a company, and 68% said the same about passkeys.
The test I apply to any step in a sign-in flow is whether the customer can see what it protects. A one-time code before a large transfer passes easily, and customers read it as care. The same code demanded before someone can check a loyalty balance fails, and it teaches the customer that your security is ceremony.
That's the equation in the title. Whenever you ask a customer to prove who they are, they weigh the effort against what's at stake for them and the confidence the step gives back. A flow that puts the same wall in front of every action gets the equation wrong twice. It asks too much for low-stakes visits and proves too little for high-stakes ones.
The industry's name for the better approach is risk-based or adaptive authentication, and the idea is simple enough to explain to a board. When the device, location, and behavior look normal, let the returning customer in quickly. Ask for more when the action is sensitive or the signals look wrong. That's what I mean by security that says yes: proof in proportion to the stakes, with the effort placed where the risk is.
The attacker uses the same door
Security teams resist loosening the front door for a good reason, and it deserves a fair hearing. Your sign-in page serves your customers and the people trying to impersonate them.
Thales's 2026 Bad Bot Report, covering 2025, found that automated traffic made up more than 53% of all web traffic and that AI-driven bot attacks grew 12.5x over the previous year. Financial services accounted for 46% of the account takeover incidents in that data. On the consumer side, FIDO's 2026 survey found that 33% of people had a confirmed account compromise or a breach notification in the past year, rising to 41% in the US.
Passwords put a company in a bad position here. A password can't distinguish a customer from a criminal holding that customer's credentials, so the only way to slow the criminal is to add checks for everyone, like the CAPTCHA and the emailed code. Legitimate customers pay for every one of those checks because the credential itself is weak. Fraud and marketing then argue about how much of that cost to impose, when both teams are working around the same flawed credential.
Account recovery is the real front door
If I could get an executive team to look closely at one flow, it would be account recovery. A customer arrives there at their most frustrated, having already failed to get in. A prepared attacker aims there too, because recovery exists to let someone in without the usual credential. In a lot of consumer products, the whole flow rests on a code sent by text message or a link sent to an inbox.
NIST's digital identity guidelines, SP 800-63B-4, finalized in July 2025, classify one-time codes delivered over the phone network, by SMS or voice, as a restricted authenticator. The guidelines are written for US federal systems. Any organization following them that keeps using phone-delivered codes has to offer customers an unrestricted alternative, tell them about the risk, account for it in its risk assessment, and keep a migration plan in case the method stops being acceptable. The US standards body has put the channel many consumer apps lean on for recovery on notice.
Recovery also tends to be designed after the sign-in page has been through its reviews, as an edge case. I'd reverse that priority. Recovery is where, I'd argue, churn and fraud meet. A company that makes it fast and safe has fixed its weakest moment. One that hasn't is showing that weak moment to its most frustrated customers and its most motivated attackers at the same time.
Passkeys belong in the growth plan
The best evidence that security and experience can improve together comes from passkeys, and it's why I think passkey programs should be run and funded as conversion projects. The FIDO Alliance's Passkey Index, published in October 2025, pooled confidential data from nine large deployers, among them Amazon, Google, PayPal, and Target, each with one to three years of passkeys in production. Passkey sign-ins succeeded 93% of the time, compared with 63% for other methods, a group that includes social login, one-time codes, and MFA. A passkey sign-in took 8.5 seconds, against 31.2 seconds for traditional MFA, and some participants reported up to an 81% reduction in sign-in related help desk incidents.
Treat those as results from large platforms that invested heavily, which makes them a best case. The best case still matters. For a customer, time-to-yes is the gap between the sign-in prompt and being in, and every failed attempt forces a decision about whether you're worth another try. FIDO's consumer survey already showed how many people are prepared to decide you aren't.
Passkeys also resist phishing, and NIST's guidelines accept synced passkeys at their second assurance level. The change that lifts sign-in success shrinks the stolen-password problem for every account that adopts it. The customer never sees the cryptography, which is how invisible infrastructure is supposed to work, and experiences a sign-in that takes seconds and works the first time.
The same report shows how far even these companies have to go. Across the nine participants, 93% of accounts were eligible for passkeys, yet 36% had one enrolled, and passkeys handled 26% of sign-ins. Customers are already familiar with them: FIDO's 2026 survey found 75% had turned passkeys on for at least some of their accounts.
Offering passkeys is an engineering task. Getting customers to use them is a product and marketing task, and I'd give it to whoever owns onboarding conversion. The work will look familiar to any growth team. Pick the moment to ask, which might be right after a successful purchase or right after a painful password reset. Write the prompt so the benefit is obvious, test it, and track enrollment the way you'd track adoption of any feature. Then set a date to stop offering the password as a fallback, since attackers go after the weakest option you leave available.
Stop asking strangers to register
Registration walls make the same mistake earlier in the relationship. Baymard Institute's checkout research found that 18% of shoppers had abandoned an order because they didn't want to create an account, and that 62% of the sites it benchmarks fail to make guest checkout the most prominent option.
A forced account asks for commitment before the company has delivered anything. I'd flip the order. Let people buy as guests, and offer the account at the moment it's useful to them, on the order confirmation page, where tracking a delivery gives them a reason to want one. With a passkey, creating that account can take a single confirmation and no password, so the customer's first contact with your identity system is something that helped them. Access becomes an accelerator when it shows up after the customer has already gotten value.
I'd apply the same thinking to every question you ask. Collect a detail when there's an obvious reason to need it, instead of front-loading a long form at sign-up. Customers are more willing to answer when they can see why you're asking.
Personalization runs on knowing who's there
Every personalization plan assumes the company knows who it's talking to, and identity is what makes that assumption true. When the same person is a signed-in profile in your app and an anonymous visitor on your website, the personalization engine is guessing, and each channel treats a loyal customer like a partial stranger.
Trust then decides how much data customers hand over, and consumer brands start from behind. When Thales asked which sectors consumers feel comfortable sharing personal information with online, banking led at 57%. Retail was at 10%. Only 16% of consumers said they clearly understand how companies collect and use their personal data. And while 66% said they trust companies that make privacy settings easy to manage, just 8% said they find those settings easy to use.
My own read, which the survey didn't test, is that those numbers describe an identity experience as much as a privacy one. The preference center and the screen where a customer sees what they've shared are identity capabilities. They tend to get built to satisfy a compliance requirement. I'd treat them as trust assets, put them where customers can find them, and measure whether people use them. The data your personalization roadmap depends on is data customers choose to give, and they give more to companies that let them stay in control of it.
When the customer sends an agent
The next change at the front door is delegation. I expect AI agents that sign in and buy on a customer's behalf to become an ordinary part of commerce, and customers are uneasy about it. Thales found 77% of consumers concerned about AI agents acting on their behalf online, and only 23% said they trust companies to use AI responsibly with their data.
I'd argue most of that unease is an identity question. A company serving an agent needs to know which agent is acting, which customer authorized it, what it's allowed to do and spend, and how the customer revokes that permission. An account model built around one person typing a password has no clean answer to any of those.
We've seen an early version of this problem. For years, financial data aggregators logged in to bank websites with customers' own usernames and passwords, because there was no better way to act on a customer's behalf. The industry has been moving to access that the customer grants and can revoke without handing over a password, and the move has been slow. I'd rather retail and travel skipped the credential-sharing phase with AI agents entirely.
What follows is my view, with no survey behind it. Customers will let agents transact with the brands that make delegated access easy to see and easy to revoke. Companies that already treat identity as part of the customer experience will extend what they have. The rest will be designing agent consent from scratch while their customers' agents shop somewhere else.
Measure your identity experience score
None of this moves until someone measures it in terms a marketing leader recognizes. There's no industry standard for an identity experience score, so here is the version I'd start with. Every input is something your teams already collect, usually in separate tools, and the weights are my starting point to adjust.
- First-attempt sign-in success, by method (25 points). How often a returning customer gets in on the first try. The passkey deployers above report 93% for passkeys, which is a useful ceiling to compare against.
- Recovery completion (20 points). Of the resets customers start, how many end with the customer signed in. A reset that starts and never finishes is an abandoned visit with a support cost attached.
- Account-step drop-off (20 points). How many shoppers leave at registration or at the account step of checkout.
- Time to sign in (15 points). Median seconds from the prompt to a signed-in customer.
- Passkey adoption (10 points). The share of active accounts with a passkey, and the share of sign-ins that use one.
- Consent findability (10 points). Whether customers can find and change their preferences without contacting support.
Score each measure against your own baseline first, then against the best benchmark you can find. Report the total in the same review where conversion and retention get discussed, with one owner who answers to both the CMO and the CISO. A number reviewed only by the security team will keep getting optimized for keeping people out.
Every return visit starts at the sign-in screen, and identity powers everything a customer does with you after that, including the parts marketing gets credit for. Nearly half of consumers say a forgotten password could end a purchase, and a third say a clumsy sign-in is enough to send them to a competitor. Your customers are already scoring that first impression. Measure your identity experience score, and put it in front of the people who are paid to keep customers.