Nearly half of all internet traffic now comes from non-human sources, and bad bots make up close to a third of it, according to Imperva's 2024 Bad Bot Report. That number reframes the case for friction. The industry spends its energy removing every pause from a signup, yet some of those pauses are the only thing standing between your database and a script that never sleeps.

I study behavioral psychology, and the friction conversation fascinates me because it is almost always framed as a bug. One-click checkout, frictionless onboarding, instant access. Speed is treated as an unqualified good. Most of the time it is. Sometimes it is exactly how a system leaks.

What is the case for friction?

The case for friction is simple: a small, intentional slowdown at the right moment protects the user and the business more than a perfectly smooth path would. A confirmation step, an email verification, a rate limit, a short cooling-off pause. Each one costs a legitimate person a few seconds and costs an automated attacker their entire economic model.

This is not about making things hard. It is about deciding where effort belongs. Behavioral economists Richard Thaler and Cass Sunstein gave us the word "sludge" for friction that blocks people from outcomes that would help them. The Decision Lab's reference on sludge makes the counterpoint plainly: some friction is used ethically, so that a person will "think twice about what data we are sharing online."

The distinction that matters is intent. Friction that serves the person is protective. Friction that serves only the company, hidden cancellation flows, buried fees, is sludge. Same mechanism, opposite ethics.

When friction is protective, not sludge

The clearest evidence comes from account security. Microsoft reported that turning on multi-factor authentication blocks more than 99.9 percent of automated account compromise attacks. MFA is friction. It is one more step, and that one step defeats the overwhelming majority of bulk credential attacks running against every login page on the internet.

The same logic runs through consumer protection law. The FTC's Cooling-Off Rule gives buyers three business days to cancel certain sales, specifically so people can research, compare, and consult before a high-pressure decision hardens into regret. The pause exists because regret is expensive and reversal is cheap when you build the window in.

Protective friction shares a signature. It is short. It is placed at the moment of highest risk. And it works in the user's favor, not against them. That is the line I hold when I look at any onboarding flow.

What deliberate friction filters out

Automated signup fraud is not a rare event. New account fraud drove an estimated $6.2 billion in losses in 2024, per Javelin research cited by TransUnion, and much of it starts with bots opening accounts at machine speed. A frictionless form is a welcome mat for exactly that traffic.

Deliberate friction is the filter. The OWASP Credential Stuffing Prevention Cheat Sheet recommends layered controls: MFA as the primary defense, rate limiting to cap request volume, and CAPTCHA reserved for logins that already look suspicious. Notice the design principle. You do not slow everyone equally. You slow the requests that carry risk.

The payoff is not only fewer bad actors. It is cleaner data. Every fake account you keep out is a row you never have to detect, quarantine, and delete later. This is the same reason data governance is the prerequisite for AI: models and analytics inherit the quality of what you let in the front door. Friction at intake is governance you do not have to retrofit.

Good friction versus bad friction

Not all friction earns its place. Careless friction, a confusing field, a form that rejects valid input, a slow page, is just bad engineering wearing a security costume. It filters out your customers, not the bots. This is why I separate protective friction from sludge so carefully.

The test I use has three questions. Does the pause reduce a real risk, or just exist? Is it at the point of highest exposure, or scattered everywhere? Does it work for the user, or only for us? Protective friction passes all three. Sludge fails the third and usually the first.

Placement is everything. Excess steps in the wrong spot become cognitive load, and cognitive load is what kills conversion rates. The goal is not more friction. It is the right friction in one deliberate place, with a frictionless path everywhere else. A well-set default often does the protective work with no visible step at all.

Where to add friction on purpose

Start where the damage concentrates. A double opt-in on email verification stops most throwaway signups. A rate limit on your registration and login endpoints caps how fast any single source can hammer them. A confirmation step before an irreversible action, deleting data, sending money, sharing a record, converts a regret into a second thought.

This is also a defense against manufactured urgency. When a flow is engineered to make you act before you think, the antidote is a built-in pause, the same reasoning behind why "this pricing expires Friday" is a reason to slow down. A cooling-off moment protects the person from the pressure and protects you from the fallout.

None of this requires a heavy security product. It is a byproduct of good engineering, systems that do not leak by default because someone decided where a pause belonged. That is the same posture behind the attack baseline every small website already faces and the reason we treat every sub-processor as a data policy you inherit. At Kief Studio we build friction the way we build everything else, on purpose and in the user's favor.

Frequently Asked Questions

Is not friction always bad for conversion?

Not always. Friction that removes bots, fake accounts, and impulse regret can raise the quality of who converts, even if it slightly lowers the raw count. The right question is not how fast the path is, but who reaches the end of it. A form full of real, verified people is worth more than a form full of noise.

How do I tell good friction from bad friction?

Good friction reduces a real risk, sits at the point of highest exposure, and works in the user's interest. Bad friction, often called sludge, exists to benefit the company through confusion or delay. If a step protects the person taking it, keep it. If it only protects your metrics, cut it.

What is the simplest protective friction to add first?

Email double opt-in and a rate limit on your signup and login endpoints. The first stops throwaway and typo signups from polluting your data. The second caps how fast any single source can attack your forms. Both are low effort for real users and high cost for automated abuse.

Does adding friction mean I do not need other security?

No. Protective friction is one layer. Security guidance consistently recommends combining rate limits and CAPTCHA with multi-factor authentication and monitoring, because no single control stops a determined attacker. Friction is where good engineering starts, not where it ends.

Ux

The Case for Friction: When Slowing a Signup Protects Your Data