Login Nightmare Made Reality: Are These Customer Identity UX Mistakes Costing You Conversions?
As end users, we’ve all been there — that moment where you want to yell at your health insurer or cable company about how frustrating it is just to login and pay a bill. It’s almost a universal annoyance at this point, like catching a cold or forgetting to switch the laundry.
In the realm of Customer Identity and Access Management (CIAM), providing a smooth and delightful user experience is crucial. The world is full of companies that inflict needless frustration on their customers with simple missteps that turn their user experience from a delight into a chore.
Take a moment and try your own company’s signup, sign-on, and multi-factor experiences. How many of these sins is your company committing?
1) Requiring CAPTCHAs
Classic CAPTCHA technology, with scrambled letters and numbers or patterns of images, has been a solved problem for attackers for many years. With simple software or by simply hiring someone to sit in a room completing CAPTCHAs all day, they’re no obstacle. Now, with AI providing powerful image recognition tools to everyone in the world, they’re not just dead, they’re buried.
Do this instead: Rather than annoying your customers with useless CAPTCHAs, protect against automated attacks by implementing modern DDoS protection and “invisible” CAPTCHA technology that silently evaluates whether there’s a human behind the keyboard using user input behaviors in the background of the web page or app.
2) Breaking password managers
Password managers are one of the best tools people have in their self-protection toolkit. They allow users to keep passwords unique across every website that supports them while also cutting way back on password resets.
So why do so many websites and apps disable autofill or, worse, mis-tag form fields, causing password managers to put information in the wrong fields?
Do this instead: Embrace the password manager! Enable autofill wherever it is safe to do so and encourage users to use password managers. Test forms to ensure that autofill with popular password managers works perfectly.
3) Requiring too-frequent password changes
Frequent password changes are a familiar practice for anyone who’s worked in the corporate world. It’s meant as a security measure, but research has shown that it instead increases password reuse, account sharing, and time wasted on help desk calls. NIST now recommends that passwords be rotated even for workforce users only once per year.
Given all of this, how can a company expect its customers — who have much less time on their hands and many accounts to manage — to keep track of new passwords all the time when we know that even employees can’t keep them all straight?
Do this instead: Never expire customer passwords except in case of breach. Subscribe to one of the publicly available lists of compromised passwords and regularly check user passwords against those lists, notifying users when their password has been compromised in a breach and giving them opportunities to change it.
4) Asking way too many questions
4) Asking way too many questions“Thanks for signing up! Now, we’re going to ask you questions for the next five minutes before we let you get to the thing you signed up for…”
Don’t lose a conversion after someone has already signed up! Most people are not signing up for a bunch of work when they initially interact with your business — they’re dipping their toes in the water to learn more. There is no time more important than that first encounter to set a tone.
Far too many companies do far too much in that first session. The goal should not be to gather everything; it should be together exactly what you need to make the customer’s experience as good as possible from that point on.
Do this instead: Deploy progressive profiling. At the first interaction, gather exactly what you need to get the user up and running with their new account, or just to make their first purchase. Take advantage of everything you can appropriately request from their portable identity. Then, as they continue to visit your site and open your app, ask more questions and do so in a friendly, fun way.
Let the customer feel that they’re building a profile with you that will help them, not that you’re demanding information or else.
5) Not supporting your customers’ preferred factors
Authentication can be very high-friction for users, particularly when they’re less technologically inclined. Older and slower-typing users, in particular, often struggle with authentication methods that require navigation from device to device or from app to app to find a code and copy it to an application.
Many companies also simply overdo it on this front, asking customers to do a multi-factor authentication too frequently and for non-sensitive actions. This extra friction can really add up in user dissatisfaction and support calls.
Do this instead: No matter what industry you’re in, or what kinds of customers you serve, your customer identity system needs to support the most accessible factors — text message and email. Add authenticators and hardware tokens only for the most sensitive kinds of access, like bank withdrawals and expensive purchases. Moreover, take advantage of the power of adaptive access controls, which can require step-up authentication with a tougher factor only when a sensitive action is being undertaken.
6) Not supporting your customers’ portable identities
By now, just about everyone has at least one social login, whether it’s Google, Apple, Facebook, or even less-common providers like LinkedIn and Github. Yet, somehow, many B2C companies still haven’t added social logins to their customer journeys.
Instead, the customer has to go through all of the steps and frustration of creating a new account, with a new username and password to forget, another profile to manage, and yet another place where their data is stored to potentially be lost or stolen.
Besides all of these downsides for the customer, there are also major downsides for you the business — lack of social logins dramatically increases the number of duplicate signups and reduces the quality of user data in your CIAM platforms.
Do this instead: Consider what social logins your users are most likely to prefer, and enable them! Besides the most popular social login providers of Google, Apple, Facebook, and X/Twitter, consider LinkedIn for B2B clients and Github for technology-focused customers.
And, worst of all…
7) Multiple logins for multiple systems
Whether you serve dedicated clients, in-person retail consumers, business customers, or just people casually shopping from their phone, being easy to do business with is crucial to your CIAM strategy. Every encounter with your company shapes the perception your customers have of you, and friction is memorable.
When your customers think about doing business with you, what do you want them to think? “Ugh, I have to log in to three different things to get this done… Where did I put those passwords?” Or, “I’ll just log in really quickly and buy those, won’t take any time at all!”
Do this instead: Don’t make the customers do the work for you — integrate your systems. Put every customer-facing platform under the same single sign-on regime and make every transaction feel seamless and unified.
Conclusion
In today’s digital landscape, providing a seamless and frustration-free customer identity and access management (CIAM) experience is paramount for businesses to thrive. By avoiding these seven deadly sins of customer identity UX, you can ensure a delightful user journey, boost conversions, and foster long-lasting customer relationships.
Remember, every interaction shapes your brand’s perception, so prioritize simplicity, convenience, and a unified experience across all your customer touchpoints. Embrace modern authentication methods, leverage social logins, and implement adaptive access controls to strike the perfect balance between security and usability. By putting your customers’ needs first, you can unlock the true potential of your customer identity management strategy and stay ahead of the curve in an increasingly competitive digital world.
Author: Nick Slabaugh, IDMWORKS, Director of Technical Solutions,
