Multifactor Prompts Add 38 Seconds Before the First Bet

Account creation at three of the largest U.S. sportsbooks now takes 38 seconds longer, on average, than it did in January 2024 — a jump from 71 seconds to 109 seconds across sign-up, identity verification, and payment setup. The figure comes from a 400-session audit conducted in February 2025 by payments consultancy Auriemma Group, which timed the process on desktop and mobile web at DraftKings, FanDuel, and BetMGM using clean browsers and real credentials.

That's the cost of multifactor authentication, and it's landing squarely on the part of the funnel where operators can least afford friction.

Why the extra seconds showed up

Multifactor prompts weren't standard at sign-up two years ago. Most books relied on a single knowledge factor (password) plus a behind-the-scenes KYC check that ran asynchronously. Now, a typical flow asks for a password, a one-time code sent to a phone number or email, and sometimes a biometric check on the device itself before the first deposit screen loads.

The 38-second delta breaks down unevenly. Auriemma's session logs attribute roughly 19 seconds to waiting on SMS delivery and entry, 11 seconds to re-prompting after a code failure, and 8 seconds to a second identity challenge triggered when the phone number on the account didn't match the carrier record. That last category is the one operators quietly worry about: it's not a security step working as intended, it's a mismatch between two databases that the customer can't resolve without a support call.

The regulatory pressure behind the prompts

The shift isn't arbitrary. Since the Wire Act reinterpretation fights of 2019–2021 and the subsequent state-by-state rollout of iGaming and sports betting, regulators have pushed operators toward stronger authentication as a condition of licensure. New Jersey's Division of Gaming Enforcement updated its technical standards in 2023 to require "multi-factor authentication for account access where technically feasible." Pennsylvania followed with similar language in 2024. Michigan's rules stop short of mandating MFA but require operators to document "reasonable account security measures," which compliance teams have read as a nudge in the same direction.

The result is a patchwork. A player in Newark might get a different prompt sequence than the same player in Philadelphia, even on the same operator's app, because the compliance stack is configured per jurisdiction.

What 38 seconds actually costs

Thirty-eight seconds doesn't sound like much until you multiply it. If a mid-size operator pushes 50,000 new sign-ups a month and converts 22% of them to first deposit, that's 11,000 depositors. A 38-second delay at a documented 4% abandonment rate per additional 10 seconds of friction — a figure that's been floating around conversion-optimization circles since at least 2021 — implies roughly 1,700 lost depositors per month. At a $180 average first deposit, that's about $306,000 in monthly handle that never gets wagered.

Operators know this. Several have started offering "skip for now" options that defer the second factor until the first withdrawal, which regulators have generally tolerated as long as the deposit itself is verified. Others are pushing passkeys, which drop the prompt time to under 5 seconds but require the player to have a compatible device and to opt in.

The open question

The real tension isn't whether MFA is worth it — it plainly is, given the account-takeover losses that plagued the industry through 2022. The question is who absorbs the friction. Right now it's the new customer, at the exact moment they're deciding whether to trust a platform with their bank details. Whether that changes depends on whether regulators accept deferred authentication as a legitimate compromise, or whether the 38 seconds becomes the permanent entry fee for a legal U.S. bet.