Two-Factor Prompt at Login Adds 11 Seconds, and 1 in 4 Bail
A two-factor authentication prompt at login adds a median 11 seconds to the process, and roughly one in four players who hit it never finishes signing in. Those are the headline numbers from a login-funnel analysis covering 14 US-facing operators over a 60-day window ending March 31, 2025. The finding matters less for what it says about security than for what it says about the trade operators have quietly made: they have added friction at the exact moment a customer's intent is highest, and a measurable share of them are walking away rather than waiting.
The data came from a vendor that instruments login flows for regulated operators, and it was shared on condition the operators not be named. The sample covered 6.2 million login attempts across desktop and mobile web, with native apps excluded. Of attempts that triggered a second factor — a code by SMS, an authenticator app push, or an emailed link — 24.6% were abandoned before completion. Median completion time for users who did finish was 11.4 seconds from prompt to verified session, though the distribution has a long tail: the 90th percentile sat at 41 seconds, and the 99th at just under three minutes, almost entirely driven by SMS delivery delays.
What the abandonment actually looks like
The 24.6% figure is an average, and the averages hide most of the interesting variation. Break it down by method and the picture changes sharply.
SMS versus authenticator apps versus email
SMS codes had the worst completion rate of the three common methods, at 71.2%. Authenticator app pushes completed at 88.9%, and emailed links at 79.4%. The gap between SMS and app-based push is the single largest lever in the dataset — nearly 18 percentage points of completion — and it tracks almost exactly with delivery latency. Median SMS delivery in the sample was 7.8 seconds; a push notification that reaches a phone already unlocked resolves in under two.
That matters because SMS remains the default second factor at most US operators, largely because it requires nothing from the customer beyond a phone number already on file. It is also, from a security standpoint, the weakest of the three: SIM-swap fraud and interception attacks are well documented, and the National Institute of Standards and Technology has discouraged SMS as a factor for high-assurance authentication since 2016. Operators have kept it because it maximizes enrollment. The funnel data suggests it also maximizes abandonment, which is a cost that rarely shows up on the same spreadsheet as the fraud loss it's meant to prevent.
The device split
Mobile web abandoned at 28.1%, desktop at 19.3%. Some of that is a population difference — desktop sessions skew toward older, more established accounts that have already been through the prompt once and have the device remembered. But the vendor's analysts also flagged a mechanical issue: on mobile web, an SMS code arrives in a notification that covers the input field on some Android browsers, and users who tap the notification rather than switching apps manually lose their session state. That's a fixable interface bug masquerading as a behavioral statistic.
The 11 seconds is not evenly distributed, and the tail is where the damage is
Eleven seconds sounds trivial. It isn't the median that costs operators money; it's the tail. Users who waited more than 30 seconds for a code abandoned at 61%, and users who had to request a resend abandoned at 74%. A resend request is effectively a confession that the first code never arrived, and in the sample, 8.3% of SMS attempts required at least one resend.
There's a compounding effect worth noting. The analysis looked at sessions where the second factor fired on a deposit attempt rather than a routine login — a re-verification triggered by a new device or a risk score — and abandonment there ran higher, at 31.7%. That's the worst possible place to lose someone: they have already decided to deposit, and the prompt arrives between the decision and the transaction. Operators commonly describe this as "protecting the player." The player, in that moment, experiences it as the site failing.
A rough revenue estimate: if an operator processes 400,000 second-factor prompts a month and 24.6% abandon, that's roughly 98,000 lost sessions. Not all of those are lost customers — many return later — but the vendor's re-engagement data suggested only about 40% of abandoners completed a login within the following seven days. The rest either went elsewhere or didn't come back at all.
Why operators keep the prompt anyway
The compliance case is not imaginary. State regulators, particularly in the wake of account-takeover incidents that drained player balances in 2023 and 2024, have pushed operators toward stronger authentication. Several states now require multi-factor authentication for account changes — password resets, bank details, withdrawal addresses — and a handful have floated broader requirements. The American Gaming Association's voluntary frameworks lean the same direction. An operator that removes its second factor to shave abandonment is inviting a regulatory conversation it does not want to have.
But there's a gap between "require a second factor for sensitive changes" and "require a second factor on every login," and the funnel data suggests operators have been slow to draw that line. The 14 operators in the sample triggered the prompt on every login for 62% of the accounts observed. Only four of the 14 used any form of risk-based triggering — skipping the prompt when the device fingerprint, IP, and behavioral signals matched a known-good profile. Among those four, second-factor prompts fired on just 22% of logins, and overall login abandonment was 9.1%, roughly a third of the sample average.
Risk-based authentication is not free. It requires device fingerprinting infrastructure, a risk-scoring model, and the willingness to accept that some fraction of bad logins will slip through without a challenge. It also requires operators to trust their own models enough to skip a step that regulators might later ask why they skipped. That's an organizational problem more than a technical one, and it explains why adoption has been uneven.
The customer-service cost nobody budgets for
Every abandoned second-factor session that turns into a support contact costs money. The vendor's data included a support-ticket correlation: accounts that abandoned a login were 3.4 times more likely to open a ticket within 48 hours than accounts that completed one. At a fully loaded cost of roughly $4 to $7 per contact depending on channel, a mid-sized operator with 100,000 monthly abandonments is looking at somewhere between $1.4 million and $2.4 million a year in avoidable support volume — before counting the deposits that never happened.
What actually moves the number
The interventions that showed measurable improvement in the dataset were unglamorous.
Remembering the device for 30 days cut repeat prompts dramatically. Operators that implemented a 30-day trusted-device window saw second-factor prompts drop by 58% among returning users, with no corresponding increase in account-takeover reports over the observation period. The caveat is real: a trusted device is only as trustworthy as the device, and shared or resold phones are a known vector.
Switching the default from SMS to an authenticator app or passkey improved completion by roughly 18 points, but only for users who had already enrolled. Enrollment is the hard part — operators that pushed app-based factors at signup saw enrollment rates in the low 30s, versus 90%-plus for SMS, because SMS asks nothing of the customer. The vendors that made progress did it by framing enrollment as a faster login rather than a security upgrade, and by offering it at a moment when the user was already invested — after a first deposit, not at account creation.
Pre-filling the code field and auto-submitting on paste sounds like a rounding error and wasn't. Operators that implemented it saw median completion time fall from 11.4 to 8.9 seconds and abandonment drop by about 3 points. Small, cheap, and almost entirely a front-end change.
Showing a visible countdown and a one-tap resend reduced the resend rate from 8.3% to 5.6% in the operators that tested it. The mechanism is probably psychological — a user who can see the clock knows whether to wait or act — but the effect was consistent across the sample.
None of these interventions compromise the security posture in any meaningful way. They reduce the number of times a legitimate user is asked, and they make the asking less painful when it happens. The security benefit of a second factor comes from its presence on risky logins, not from its presence on all of them.
The question operators haven't answered
The uncomfortable implication in the data is that the 24.6% abandonment rate is not a fixed cost of doing business securely. It is a function of design choices — SMS as default, no device memory, no risk-based skipping, a clumsy input field — that operators made for reasons of enrollment convenience and implementation speed, and have mostly not revisited. The four operators using risk-based triggering cut abandonment by two-thirds without, as far as the data shows, a corresponding rise in account takeovers.
Which raises a question the industry has been slow to ask out loud: if a risk-based approach can authenticate most logins invisibly and reserve the prompt for the ones that need it, what is the second factor on every login actually protecting — the player, or the operator's ability to say it did something? The answer probably varies by operator and by state, and the regulators who will ultimately weigh in have not yet said which trade-off they prefer. Until they do, the 11 seconds and the one-in-four walkaway are a choice, not a requirement. Players who abandon a login in frustration are not usually thinking about SIM-swap fraud or state compliance rules. They are thinking about whether they want to gamble badly enough to wait for a text message. A quarter of them, it turns out, decide they don't — at least not on that site, on that day.