Risk-based, adaptive authentication is the current answer: applying stronger verification only when a transaction or behavior pattern actually signals higher risk, rather than applying the same friction to every user regardless of context. Explaining a security step at the point it’s requested, also reduces drop-off without weakening the check itself.