Operators that moved their two-factor prompt from login to the withdrawal screen reported a 27% drop in account-access support tickets over the following quarter. The number comes from a six-operator sample tracked between January and March 2024, covering roughly 412,000 withdrawal requests. The mechanism is unglamorous: the prompt lands at the moment a player actually has something at stake, so it gets completed instead of abandoned.

Why the login prompt was the wrong place

Login-time 2FA has a predictable failure mode. A player opens the app on a train, gets an SMS code, waits, retries, and by the third attempt they've forgotten why they wanted in. That friction generates tickets — "I'm not receiving codes," "my number changed," "I'm locked out" — none of which have anything to do with fraud.

Move the same prompt to the withdrawal confirmation and the psychology flips. The player is motivated, they're on a stable connection more often than not, and the code arrives while they're staring at the screen. In the sample, 2FA completion rates rose from 61% at login to 89% at withdrawal. Same technology, same SMS gateway, different moment.

There's a second effect that operators rarely plan for but consistently report: fraud teams get cleaner signals. A login prompt fires hundreds of times per user per year. A withdrawal prompt fires a handful. The latter is a far better place to hang risk scoring.

The support-ticket arithmetic

The 27% figure is a blended average, and it hides a wide spread. The best-performing operator in the sample cut access-related tickets by 41%; the worst managed 9%. The difference tracked almost entirely with how well they explained the prompt in-app.

Broken down by category, the drop was uneven:

• "Code not received" tickets: down 52%. Players were no longer requesting codes on flaky mobile connections at 2am.
• "Can't log in" tickets: down 34%. Removing the login gate removed the gate-related complaints.
• "Why is my withdrawal pending" tickets: up 11%. This is the honest cost. Some players hit the 2FA step, complete it, and then wait on a manual review that has nothing to do with authentication.

That last line matters. Cutting access tickets by a quarter while adding a small volume of status-query tickets is still a net win on headcount, but it's not free.

Where the savings actually land

Support cost per ticket in the sample averaged €4.10. At 412,000 withdrawals and an assumed baseline of 0.9 tickets per withdrawal, the 27% reduction works out to roughly 100,000 fewer tickets per operator per quarter — about €410,000 in avoided cost. That's the number finance teams care about, and it's the one worth putting in front of a CFO who thinks 2FA is purely a compliance line item.

What breaks the model

Withdrawal-screen 2FA depends on a few things holding:

1. The prompt must be skippable for small amounts. Operators that applied it to every withdrawal above €10 saw completion rates crater. A €50 threshold preserved most of the savings while cutting friction complaints.
2. The code must arrive in under 20 seconds. Above that, players abandon the session and call support — which is exactly the ticket you were trying to eliminate.
3. Fallback methods need to exist. Authenticator apps and email backup cut SMS-dependent tickets by another 18% in the two operators that offered them.

None of this is technically novel. What's novel is treating the 2FA prompt as a product decision rather than a security checkbox. The placement of a single screen changed the support economics more than most fraud-tooling upgrades do.

An open question for anyone running the numbers

If withdrawal-time 2FA cuts support load by a quarter, does it also change player behavior in ways the sample couldn't see? Players who hit a prompt before cashing out may withdraw less often and in larger amounts — or they may drift to operators without the friction. The six-operator sample ran for one quarter and tracked tickets, not lifetime value. That's the study someone should run next.