How to Reduce Checkout Abandonment at the Payment Step in 2026

Checkout abandonment at the payment step is when a ready-to-buy customer cannot complete payment: the card is declined, authentication adds friction, their preferred method is missing, or the page fails. Baymard records an average documented cart abandonment rate of 70.22%. The payment layer addresses the share of that loss operators directly control.

Someone has asked about your checkout conversion rate and you do not have a complete answer. The obvious work is done: guest checkout, fewer form fields, delivery costs shown before the final screen.

The number moved a little, then settled. What remains sits at the end of the funnel, between "pay now" and an approved authorisation, where people who decided to buy stop buying.

That stretch fails for reasons you can measure and often engineer around, and each leaves a different fingerprint in your reporting. What follows separates the abandonment your payment layer causes from the abandonment it does not, and points you at the reports that tell you which is which. To reduce checkout abandonment where it costs most, start here.

Key Takeaways

• Shoppers give distinct payment-stage reasons: a declined card (10%), too few methods (9%), site errors (17%). The survey allows more than one answer, so these overlap.
• The largest single reason, extra costs at 40%, is a pricing problem no payment stack fixes.
• Tokenising stored credentials is the best-evidenced authorisation lever: Visa reports a four percent uplift against raw card numbers.
• Reducing authentication is the wrong move. The legitimate route is the exemption regime, applied by your provider.
• Missing methods leave no decline code behind, so that loss stays invisible unless you check method mix by market.
• The headline rate cannot tell you which share is yours. Only the reason-level split separates work you can do from work you cannot.

1. How much of your checkout abandonment is yours to fix

The headline rate is context. The reasons carry the useful information, because the rate alone cannot tell you which part of the loss is yours.

Baymard's research averages 50 separate studies of ecommerce cart abandonment and records why shoppers say they left. Read as causes, it splits into work you can do and work you cannot.

‍

One caution before this reaches a meeting: respondents could pick more than one reason, so the shares overlap and must not be summed.

The biggest reason is not a payment problem

Extra costs top the list by a wide margin, and nothing in your payment stack touches them. That is not a failure of your infrastructure, it is a pricing decision made upstream. It is also, reliably, the first thing raised when someone asks the payments team why checkout is underperforming.

Strip that out and four causes remain that the payment layer owns or shares: refused payments, technical failure, authentication friction, and missing methods. The first two share a fix, so they share a section.

2. Refused and failed payments

A customer whose payment fails at the final screen can be among your costliest losses: you paid to acquire them, and they intended to pay. Roughly one in ten abandoning shoppers blames a declined card, and few try again.

Why good transactions get refused

The decision to approve belongs to the issuer, not to you or your provider. What you influence is the quality of the information it sees.

Stored credentials go stale as cards are reissued. A transaction routed through an acquirer performing poorly in the customer's market looks riskier than the same one routed locally. And a raw card number carries less context than a network token. 

That last point is the best-evidenced lever here: Visa's data shows tokenised transactions deliver a four percent uplift in authorisation and a 30 percent reduction in online fraud against the raw card number. That is a network-token figure rather than a general recovery rate, but it comes from the scheme, not a vendor.

When the route itself fails

Site errors and crashes account for another 17%. At the payment step that means a timeout, a provider outage, or a redirect that never returns. No published figure of the necessary quality exists for what latency costs, so treat it as real but unquantified.

One response that can also help recover  declines: a single provider is a single point of failure, and with a fallback route an outage may become  a slower payment rather than a lost sale.

The levers worth asking about:

• Tokenised credentials for anything stored, so reissued cards do not rot in your vault.
• Routing to the acquirer performing best for that market and card type.
• A fallback route, so one refusal or outage is not the end of the attempt.
• Decline reasons, read rather than counted. Insufficient funds and a stale credential need different fixes.

3. Authentication friction, and why less authentication is the wrong answer

The 17% who call checkout too long or complicated are describing several things: form length, page count, and authentication steps. Reading all of it as an authentication problem would be careless. Some of it clearly is, and this is where most operators privately want permission to turn something off.

The fear, answered directly

The question behind that instinct is whether smoothing authentication raises fraud or breaks a rule. On the first, the evidence is unambiguous.

In their joint report on payment fraud published in December 2025, the European Central Bank and the European Banking Authority found transactions verified with strong customer authentication were less susceptible to fraud, and card fraud 17 times higher where the recipient sat outside the EEA and such authentication is not required.

So the lever is better-targeted authentication, and the rules already provide the route.

The exemptions already written into the rules

Strong customer authentication is the requirement, familiar through 3D Secure, that a payer prove who they are before a remote payment completes. The rules also name circumstances where it need not apply:

• Low risk, through transaction risk analysis. Where a provider's monitoring identifies a payment as low risk and its fraud rates and the transaction value sit within the stated limits.
• Low value. Small payments, subject to a cumulative value since the last authentication and a cap on consecutive payments.
• Trusted beneficiaries. Payments to a payee the payer has added to a trusted list. Creating the list still requires authentication.

These exemptions are applied by the payment service provider, not by the merchant, and the issuer still decides whether to accept the result. Your job is to ask whether your provider requests the ones you qualify for.

Thresholds differ between the UK and the EU and change over time, so confirm current values with your provider and your obligations with qualified counsel.

4. The methods you do not offer

9% name too few payment methods, and it is the one cause here that leaves no trace in your systems. A declined payment produces a code; a customer who wanted a method you do not offer simply leaves.

Cards are dominant, not universal

ECB figures put card payments at 57% of the total number of non-cash payments in the first half of 2025, across a base of 879.3 million cards in the euro area.

Read that carefully. It covers non-cash payments overall, not ecommerce checkouts, so it does not tell you what share of your customers want to pay by card. What it establishes is directional: a card-only checkout sits on a rail carrying most payments, not all.

Account-to-account rails are the clearest growth story. Open Banking Limited reported UK open banking payments reaching 351 million in 2025, up 57% year on year, alongside 16.5 million active user connections. Again, that covers open banking generally, not checkout adoption.

Whether method coverage is plausibly your problem:

• Compare where your traffic comes from with where your methods are available.
• Look at mobile share by market, since wallet and bank-transfer preference runs highest there.
• Check whether markets with strong local preferences convert below your average.

5. Working out which one is yours

None of this helps until you know which cause is yours. Two reports will tell you, and you almost certainly have both.

Two things to pull

1. Decline reasons by code, for the last full month. Not the rate, the reasons. If stale credentials or issuer risk decisions dominate, section 2 is yours.
2. Method mix by market, against where your traffic comes from. A market converting well below average with only cards on offer points at section 4.

Step-level drop-off separates the rest: exits after authentication point at section 3, spikes tracking provider errors at section 2.

No published benchmark for a "normal" abandonment rate survives contact with different markets and basket values, so track your own trend line rather than chase someone else's figure.

The question to take to your provider

The follow-up compresses into one question: are we requesting the exemptions we qualify for, and do we have a second route when the first fails? Where the reporting itself is the obstacle, real-time analytics across providers make the diagnosis possible, which is part  of what payment orchestration is intended to support.

What This Means for Merchants and Operators in 2026

Three things are shifting under this problem.

Tokenisation is becoming the default rather than an optimisation. On Mastercard's own June 2026 numbers, three in five of its European e-commerce transactions are tokenised and merchant tokenisation is live in 45 European countries and territories, against a commitment to full e-commerce tokenisation in Europe by 2030. Operators still storing raw card numbers are heading towards being the exception, with the authorisation penalty that implies.

Authentication is maturing, and the threat is moving. The same ECB and EBA report flagged rising fraud that manipulates the payer into authorising the payment themselves. Proving identity does not help when the genuine customer has been talked into it.

The rails are widening. The question is shifting from which cards you accept to which rails you support, and operators who notice late find out through a market-specific conversion gap.

None of this changes the method above, only how expensive it becomes to skip it.

Where to start

If you have pulled the two reports and the gap sits in routing, method coverage or reporting, that is worth a conversation. Talk to finera. about what your setup is doing at the payment step.

This article on payment security is for informational and educational purposes only.

• Not Professional Advice: The content provided does not constitute financial, legal, tax, or professional advice. Always consult with a qualified professional before making financial decisions.
• No Liability: The authors, contributors, and the publisher assume no liability for any loss, damage, or consequence whatsoever, whether direct or indirect, resulting from your reliance on or use of the information contained herein.
• Third-Party Risk: The discussion of specific payment services, platforms, or institutions is for illustration only. We do not endorse or guarantee the performance, security, or policies of any third-party service mentioned. Use all third-party services at your own risk.
• No Warranty: We make no warranty regarding the accuracy, completeness, or suitability of the information, which may become outdated over time.