When Slowing Down Is the Right Design Decision: Necessary Friction in Security UX 

Ever scanned a QR code so fast your brain panicked for a second? Here’s why making your app "too fast" might be destroying user trust.

I was at a tea shop during a break, trying to pay using a UPI QR code. I pointed my phone at the code, and within what felt like a single blink, the screen had already moved to the amount entry field. The merchant name was right there. I could see it, but everything happened so quickly that my brain didn’t have enough time to register it as confirmation.

Did it actually scan correctly? Was that the right merchant I just saw, or did I only assume it was?

I cancelled the transaction, moved a little closer to the QR code, and scanned it again. This time, I paid closer attention to the screen before entering the amount.

The first scan had worked perfectly. QR codes are designed to scan accurately even when viewed at an angle or when part of the code is damaged. The system did exactly what it was supposed to do. My hesitation came from something else. The interface moved ahead before I had enough time to process the confirmation. Everything I needed was visible on the screen. I simply didn’t have enough time to recognize it with confidence.

That small gap between what the system completes and what the user’s mind has time to process is where many security user experience issues begin. It is also where UX psychology becomes an essential part of user experience design. People need enough time to understand what the system is telling them before they feel confident enough to act.

Before going further, a quick note. This post isn’t about two-factor authentication or confirm-delete dialogs. Those are already familiar to most designers. This is about the quieter moments where an interface needs to give users enough time to understand what just happened, or where it tries to create a sense of security in the wrong place.

Does your payment flow give users the confidence to tap “Pay” without hesitation? →See How We Design Secure FinTech Experiences  

When Speed Outpaces Human Understanding 

Most of us carry the same instinct into every project: good user experience design means removing friction. Fewer steps, less resistance, and faster completion. For many digital products, that approach creates a better user experience.

When the same thinking is applied to security-related interactions without considering the context, it can introduce a different kind of risk. This issue rarely appears in a usability test because the outcome isn’t always frustration or task abandonment. People may complete an action before they have fully processed what happened. They may also continue simply because the interface keeps moving them forward.

Speed is valuable when it gives people confidence. In security-related interactions, UX psychology reminds us that people also need enough time to notice, understand, and confirm what is happening. Thoughtful security by design creates space for that confidence before the next action begins.

What Necessary Friction Actually Means 

Friction, in design terms, is anything that slows a user down or adds steps between intention and action. The word carries a negative connotation because in most contexts, it is negative. But in security UX, some friction is doing a specific job: creating space for the brain to catch up with what’s happening. 

The distinction I keep returning to: necessary friction gives the user a moment to verify. Unnecessary friction just makes them wait. 

Going back to the QR code moment, the scan worked, the merchant name appeared, and all the information was there. The design communicated everything correctly. The interaction simply moved ahead before I had enough time to process it. In a single moment, the QR code was scanned, the merchant name appeared, and the amount entry field opened. My brain hadn’t finished recognizing the confirmation before the next step arrived. I didn’t need more information or a redesigned screen. I needed the interface to pause for just a moment so what I saw became something I could confidently trust. 

That is what necessary friction means in one of its simplest forms. It isn’t an extra screen or an additional confirmation dialogue. Sometimes it is simply a brief pause that the design intentionally leaves in place. 

This idea has been part of interaction design for years, even in products people use every day. ATM cash dispensing is a good example. The sound of the notes being counted and the brief pause before the cash tray opens are partly mechanical, yet they also support the user experience. They give people time to recognize that the transaction is progressing as expected. Did the right amount come out? Did it complete? The added time and audio gave the brain something to hold onto, a signal that said: this happened, it’s done, you can trust it. 

Caption: An ATM dispensing cash demonstrates how physical feedback and brief pauses help users trust that a transaction is complete. 

The same logic appears in certain verification screens inside apps and platforms. The check finished in milliseconds, but the screen holds for a moment before moving on. That pause isn’t about processing time. It’s about perception time. UX psychology shows that people build confidence when they have enough time to perceive and verify what has happened.

Designing for the time a brain needs to feel confident isn’t a workaround. In security contexts, it’s part of the job.

Your product may be secure. But do your users feel secure while using it? Find out with our UX Research. It’s free → Explore Our UX Research Services.

When Security Becomes an Unconscious Action 

Here’s something I’ve been thinking about more carefully since payment apps started pushing fingerprint authentication to authorise transfers, not just to open the app, but to confirm the actual send. 

When a Secure Action Becomes a Habit

When fingerprint authentication was new, you noticed yourself doing it. It felt deliberate. Now, for most people who use smartphones daily, the thumb reaching for the sensor is reflexive. It’s the same gesture used to unlock the phone, open an app, skip past a login screen. It barely registers as a conscious decision. 

That habit supports a smooth user experience in many situations. Frictionless authentication is fast and, in many cases, more secure than passwords. At the same time, there are situations where UX psychology suggests that an automatic gesture may not create the right level of awareness.

Caption: BHIM UPI’s biometric payment experience demonstrates the shift toward passwordless and seamless authentication. 

Why I Turned It Off 

When one of my payment apps introduced fingerprint authentication to authorise money transfers, I felt immediately uncomfortable about enabling it. authentication to authorize money transfers, I immediately felt uncomfortable enabling it. My concern wasn’t about the security of the technology. Fingerprint authentication is highly secure. My concern was that the gesture had become unconscious. 

A PIN requires a different kind of engagement. You stop, retrieve something specific from memory, and enter it deliberately. That cognitive effort is calibration. It’s the design communicating: this action has weight, treat it accordingly. 

The fingerprint removed that signal. The action that confirmed a large transfer felt identical to the action that opened my music app. I stopped using that feature. 

This isn’t an argument against biometrics. It’s a reminder that the type of friction should match the importance of the action. Fingerprint authentication works well for verifying identity and unlocking access. Authorizing financial transactions, especially high-value transfers, benefits from an interaction that gives users a brief moment of intention. A PIN often achieves that. The advantage is not that it is technically more secure. It is that the interaction encourages users to think before confirming the action. 

Designing for Conscious Action 

The real question here isn’t security versus convenience. It’s conscious action versus unconscious action. For something as consequential as sending money, unconscious is the wrong design choice. 

Some products have understood this well. Jupiter Money introduced a slide-to-confirm gesture for transfers. HDFC’s app uses a swipe to pay combined with an explicit terms acceptance step. These interactions don’t slow users down unnecessarily. They make the intention behind the action more visible.  

That is one of the goals of security by design. The interaction should reflect the significance of the decision, giving people enough time to recognize what they are about to do before they do it. 

Would your users trust your payment flow with their largest transaction?

If you’re not sure, it’s time to find out.  Evaluate Your Payment Experience → Explore Our FinTech UX Design Services

When Friction Backfires 

Not every security measure improves the user experience. Some forms of friction create extra work without helping people make better decisions. Over time, they become routine obstacles that users simply try to get through.

When Rules Create Predictable Behavior 

Mandatory password complexity requirements are the most familiar example. Requiring uppercase letters, numbers, and special characters appears to strengthen security. In reality, many people respond by creating passwords that follow the same predictable pattern across multiple accounts, changing only a few characters each time.

When those passwords are reused, a breach in one account can make other accounts easier to access. The friction encouraged a predictable habit instead of stronger security.

This pattern became clear enough that the National Institute of Standards and Technology (NIST) updated its digital identity guidelines. Research found that forcing people to change passwords at regular intervals often led to small, predictable changes, such as incrementing a number or replacing a single character.

The pattern here is friction that doesn’t map to any actual threat, applied uniformly regardless of context. It trains users to treat security steps as obstacles to get past rather than protections worth engaging with. Once that happens, the friction has failed because users learned to dismiss it without thinking. 

The Mistake the App Didn’t Catch 

I was on a bus once, trying to send a payment. I opened the app, got to the entry screen, and started typing. I was in the amount field, not the PIN field. I didn’t notice. I typed my PIN as the transfer amount. 

I didn’t notice. I ended up typing my PIN as the transfer amount.

The ticket collector standing next to me noticed before I hit send and stopped me. 

The fix isn’t complicated. If the app detects a transfer amount that is far higher than my usual transactions, it doesn’t have to block the payment or ask for another password. Just pause and ask: “You’re about to send ₹XXXX, is that right?” 

That’s contextual friction. It doesn’t add a step to every transaction. It adds a step when action actually looks off. The difference matters enormously, because friction that appears every time becomes noise; users click through it without reading. Friction that appears when something looks genuinely unusual gets attention, because it has earned the right to interrupt. 

This is risk-calibrated design in practice. The system should know the difference between a ₹50 chai payment and a ₹15,000 transfer, and it should respond differently to each. 

Would your interface recognize an obvious mistake before your user makes it?

Find out through a UX Audit. → Schedule Your UX Audit 

How to Tell If a Friction Point Is Earning Its Place 

Across all of this, the question I keep returning to is a simple one: is this friction helping the user, or is it just slowing them down? 

A useful way to answer that is to ask a few questions:

• Does it give people a genuine moment to verify or make a decision? Or is it a step they’ll automatically click through without reading?
• Is the amount of friction proportionate to the risk? A low-risk action shouldn’t feel like a high-risk one, and a high-risk action shouldn’t feel effortless.
• If someone skips or works around this step, what happens? Are they exposing themselves to a real security risk, or simply avoiding unnecessary effort?
• Does the friction appear only when it’s needed? Or does it interrupt every interaction regardless of the context?

These questions reflect an important principle of user experience design and security by design.

If a friction point clears those questions, it belongs. If it doesn’t, it’s costing the user something without giving them anything back. 

The Conversation That’s Actually Hard to Have 

The hardest moment in a project isn’t designing the friction. It’s defending it. 

Someone points to a confirmation step and says “This is causing drop-off, can we remove it? Sometimes the answer is yes. The step is poorly timed, badly worded, or appearing in the wrong moment. Those are real user experience design problems, and the friction probably should go. 

But sometimes the drop-off is the friction working. A user who paused at a confirmation screen and decided not to proceed isn’t a lost conversion. In a financial flow, they might be someone the design just protected from a mistake, or from themselves. 

Security UX requires a different kind of reasoning than most of what we design. The goal isn’t always to get the user to the end of the flow as quickly as possible. Sometimes the goal is to make sure they actually meant to get there and to give them a real moment to find out. 

That’s what necessary friction is for. Not to slow things down, but to make sure the right thing happens when it matters. That’s an important part of security by design and, ultimately, a better user experience.

Let’s review your product through a UX strategy lens. → Book a UX Consultation  

🔔Follow Aufait UX on LinkedIn for strategic insights grounded in real-world product outcomes. 

Disclaimer: All images belong to the rightful owners! 

Frequently Asked Questions