MFA Prompt at Signup Adds 2.4s, 39% of Croats Drop Off

A multi-factor authentication prompt placed at the signup step adds roughly 2.4 seconds to registration, and in Croatia that delay is enough to lose 39% of applicants before the account is created. The figures come from a 2025 funnel audit across Croatian-facing operators — 14 licensed sportsbooks and casino brands, 1.2 million registration starts, measured on mobile connections — and they hold up across device types, though the drop-off is worse on Android than iOS. The finding matters because Croatian operators have spent the last two years bolting on security steps to satisfy AML and player-protection obligations, and almost none of them have measured what those steps cost at the top of the funnel.

Why 2.4 seconds is a lot more than it sounds

The headline number is easy to misread. A 2.4-second delay is not a 2.4-second delay in the way a page load is. It lands at the exact moment a player has decided to register, has entered an email and password, and is waiting to be let into the product. Attention at that point is at its most fragile.

The audit broke the delay down. Of the 2.4 seconds:

• 0.9s was the round trip to the SMS or authenticator provider, including a retry on roughly 6% of requests.
• 0.7s was client-side rendering of the MFA screen itself — the modal, the keyboard shift, the reflow on smaller viewports.
• 0.5s was the operator's own backend, which in several cases was re-validating the session and re-checking device fingerprint data before issuing the prompt.
• 0.3s was unexplained latency, likely CDN routing to a European edge that was not the closest one.

None of those components is unusual. Together they push past the two-second mark, which is where abandonment curves steepen sharply. In the same dataset, prompts that completed in under 1.2 seconds lost 14% of applicants; prompts that took 2.0–2.8 seconds lost 31–39%; prompts over 3.5 seconds lost more than half.

The Croatian figure is not an outlier. It sits slightly above the EU average in the same audit (34%) for two reasons the operators themselves raised: a higher share of registration traffic on mid-range Android devices, and a higher share of players registering over mobile data rather than Wi-Fi.

The Android gap

On iOS, the same MFA flow added 1.9 seconds and lost 33% of applicants. On Android it added 2.7 seconds and lost 42%. The gap is almost entirely explained by two things — older WebView implementations on devices bought before 2022, and the fact that Android users in Croatia are more likely to be on a prepaid data plan with higher and more variable latency. If your registration funnel is optimised on an iPhone 15 in a Zagreb office, you are measuring the wrong device.

What Croatian operators are actually required to do

This is where the conversation usually goes wrong. Operators hear "MFA costs you 39% of signups" and conclude they should remove it. That is not the reading.

Under the Croatian gambling framework and the AML obligations that attach to licensed operators, identity verification at or near signup is not optional. What is optional is when and how the second factor is presented. The rules require that you know who your customer is before they can deposit and play for real money. They do not require that the second factor sit between the password field and the account-creation confirmation.

That distinction is the whole game. Three patterns are in common use in the Croatian market:

Prompt at signup. The player enters credentials, then immediately faces an SMS code or authenticator prompt. Highest friction, strongest security signal at the earliest point, and the pattern that produced the 39% figure.

Prompt at first deposit. The account is created after credentials; the second factor is required before the first real-money transaction. Friction moves down the funnel to a moment when the player has more invested and is more willing to complete a step.

Deferred verification with limits. Account creation is frictionless; the player can browse, and can deposit up to a low threshold (commonly €20–€50 across the operators audited) before verification is triggered. This is the pattern that most reduces early drop-off, and it is the one that requires the most careful internal controls to stay compliant.

The audit found that operators using the first pattern lost 39% at signup on average; operators using the second lost 21%; operators using the third lost 11%. The operators using the third pattern were not less compliant — they had simply moved the compliance checkpoint to a place where it did less damage.

The KYC cost you are not counting

There is a second-order effect that rarely appears in funnel dashboards. A player who abandons at the MFA prompt has already created a partial record — an email, a phone number, a device fingerprint. Under most operators' retention policies that record sits in the CRM for months. When the same person tries again, they often hit a duplicate-account flag, which triggers a manual review, which takes 24–48 hours, which loses them a second time.

In the audited dataset, 17% of players who abandoned at the MFA prompt and later returned hit a duplicate or review flag on the second attempt. That is a compliance cost dressed up as a security win: you paid for the verification infrastructure, you collected the data, and you still did not convert the player.

The fixes that actually move the number

The operators that reduced the MFA delay did not do anything exotic. Most of the gains came from four changes, in roughly this order of impact.

Move the prompt, don't remove it

The single largest lever is timing. Moving the second factor from signup to first deposit recovered, on average, 18 percentage points of conversion in the audit — from 61% completion to 79%. The security posture does not change materially, because the player cannot deposit or wager before the factor is satisfied. What changes is that the prompt now arrives when the player has a reason to complete it.

If you keep the prompt at signup for regulatory or risk reasons, at least make it asynchronous: create the account, let the player in, and require the factor before the first deposit. Same control, different placement.

Pre-warm the provider connection

The 0.9-second provider round trip is the biggest single component, and most of it is avoidable. Operators that pre-warmed the SMS/authenticator connection at page load — issuing a token request before the player submits the form — cut that component to 0.3–0.4 seconds. The trick is to fire the request when the email field loses focus, not when the form is submitted. You are trading a small amount of provider cost for a large amount of conversion.

Operators that did this saw the total MFA delay fall from 2.4 to 1.4 seconds, and signup drop-off fall from 39% to 22%.

Fix the modal, not the backend

The 0.7-second client-side rendering cost is almost entirely a front-end problem. The common culprits: the MFA modal triggering a layout shift that moves the submit button, the keyboard opening and covering the input, and the code input not being inputmode="numeric" so the player gets a full keyboard. Each of these adds perceived delay even when the network is fast.

The operators that fixed the modal — pre-rendering it hidden, reserving its space in the layout, and setting the input type correctly — recovered 0.4–0.5 seconds without touching the backend. On Android the gain was larger, because the keyboard shift was worse.

Measure on the devices your players use

The audit's most uncomfortable finding: 9 of the 14 operators had no mobile-specific funnel instrumentation at all. They measured registration completion in aggregate and could not tell you the Android number. If you cannot see the 42% Android drop-off, you cannot fix it.

At minimum, segment registration completion by device class, connection type, and MFA latency bucket. The latency bucket is the one that tells you whether you have a 1.2-second problem or a 3.5-second problem, and those require different fixes.

What the 39% is really telling you

It is tempting to read the number as a security-versus-conversion trade-off, and to conclude that Croatian operators are choosing security at the cost of growth. The audit suggests something less flattering: most operators are not choosing at all. They inherited an MFA flow from a vendor integration, placed it where the integration documentation said to place it, and never measured what it cost.

The 39% is not the price of security. It is the price of not measuring. The operators in the same audit who kept a second factor but moved it, pre-warmed it, and fixed the modal lost 22% — and the ones who deferred verification with a low deposit threshold lost 11%. Same regulatory environment, same AML obligations, same Croatian player base. The difference was instrumentation and placement, not risk appetite.

There is a harder question underneath this, and it is the one worth leaving open. If a 2.4-second delay at signup costs you 39% of applicants, what does the next compliance step cost — the source-of-funds check at €2,000, the enhanced due diligence on a flagged account, the manual review that takes two days? Croatian operators have spent years optimising the deposit page and almost nothing optimising the compliance steps that sit between a player and their first bet. The MFA prompt is just the first one you can measure in seconds. The others are measured in days, and nobody in the market has published a drop-off figure for them yet.