Checkout Optimization Starts With Finding Where Retailers Lose Sales

Most online stores spend heavily to bring shoppers to a product page, then lose a large share of them in the last few screens. Checkout optimization is the discipline of finding out why that happens and fixing it without creating new problems in payments, fraud, security or compliance. It sounds like a design exercise, yet the decisions behind checkout touch pricing policy, payment contracts, data protection obligations, and, increasingly, how software agents buy on people’s behalf.

This guide covers what research says about abandoned carts, how a modern checkout works behind the button, what a project costs in practice, the security and pricing rules that now shape the final screens, and the questions retailers should ask vendors before committing.

Why the Last Few Screens Carry So Much Weight

The Baymard Institute, a research firm that studies ecommerce usability, maintains a running average of documented cart abandonment rates. In its September 2025 update, the figure across 50 studies stood at 70.22%. In plain terms, roughly seven of every ten carts that shoppers create are never paid for.

That number needs context. Many shoppers use the cart as a wish list, a price calculator or a way to compare delivery dates, and they never intended to buy in that session. Baymard’s own survey of US online shoppers found that 42% of respondents who had abandoned a cart said they were browsing or not ready to buy. No checkout redesign will convert that group, and a retailer that treats every abandoned cart as a recoverable sale will overestimate any project’s payoff.

The remaining abandonments are different. They come from shoppers who wanted to buy and were stopped by something the merchant controls: a surprise fee, a forced account, a confusing form, a declined card or a missing payment option. That slice is where checkout work earns its budget, and a business case should be built around it.

What Shoppers Say Drives Them Away

When Baymard set aside the browsing group and asked the rest why they left, the answers clustered around cost, friction and trust. The most common reasons were:

• Extra costs such as shipping, tax and fees were too high (40%)
• Delivery was too slow (20%)
• The shopper did not trust the site with card details (19%)
• The site required an account (18%)
• The checkout process was too long or complicated (17%)
• The website had errors or crashed (17%)
• The shopper could not see the total cost up front (12%)
• The card was declined (10%)
• There were not enough payment methods (9%)

Several of these are not interface problems at all. High shipping charges and slow delivery are commercial and logistics decisions. A declined card can reflect an issuer’s risk model, a gateway configuration or an overly strict fraud filter. That is why checkout work tends to fail when it is handed only to a design team. The fixes span merchandising, finance, operations, and payments.

Other reasons are squarely about the interface. Forced account creation, long forms and hidden totals are choices a retailer can reverse. Baymard estimates that the average large ecommerce site could raise its conversion rate by 35.26% through better checkout design alone, based on issues its testing has identified as solvable. It is a modeled estimate, not a guarantee for any single store, and the actual gain depends on how far a given checkout is from good practice to begin with.

Small Fixes That Recur in Usability Research

Usability studies repeatedly point to the same handful of changes: prominently offering guest checkout, showing the full price (including delivery) as early as possible, cutting optional form fields, using address lookup, keeping error messages next to the field that caused them, and preserving entered data when a page reloads. Baymard also reports that most sites can cut default form elements by 20 to 60 percent. None of these require new technology, which is part of why they are often overlooked in favor of more visible projects.

How a Modern Checkout Works Behind the Button

A shopper sees a form and a pay button. Behind them, several systems must agree within a few seconds. The storefront calculates the order total, including tax and shipping. A payment page or embedded field collects card data, often hosted by a payment provider so the merchant’s own servers never touch the raw card number. A gateway passes the transaction to the acquiring bank, which routes it through the card network to the issuer for approval.

Along the way, a fraud screening service may score the order, and the issuer may request extra authentication from the cardholder. Once approved, the order is written to the commerce platform, inventory is reserved, and a confirmation is sent. A failure at any step, whether a timeout at the tax service or an aggressive fraud rule, looks the same to the shopper: the sale simply does not complete.

Tokens and Digital Wallets

Two technologies shape much of current checkout design. Tokenization replaces the card number with a substitute value that is useless if stolen, which lets merchants store a payment method for repeat purchases without holding the underlying card data. Digital wallets build on the same idea, letting a shopper pay with credentials already stored on a phone or in a browser, often authenticated with a fingerprint or face scan.

Wallets help by removing the most error-prone part of the form: typing a 16-digit number, an expiry date,e and a billing address on a small screen. Large physical retailers have also moved toward them. TechAmerica.ai reported that Walmart added Apple Pay and Google Pay across its US stores, a Sign of how far shopper expectations around stored credentials have shifted. Adding wallets online is rarely a pure engineering task, though. Each method carries its own fees, dispute rules and settlement timing that finance teams need to review.

What a Checkout Project Actually Costs

The cost of changing a checkout depends far more on the underlying platform than on the size of the visible redesign. On a hosted commerce platform, many improvements arrive as settings or app installations, and the main costs are testing time and transaction fees. On a heavily customized or self-built storefront, the same change can require engineering work across the cart, payment integration, tax service and order management system.

Budget lines that are easy to miss include:

• Payment fees. New payment methods, especially buy now, pay later options and some wallets, can carry different processing costs than standard card transactions.
• Fraud and chargebacks. Removing friction can let more risky orders through. A drop in abandonment, paired with a rise in disputes, may not be a net gain.
• Compliance work. Changes to the payment page can alter a merchant’s security obligations and the scope of its annual assessment.
• Experimentation infrastructure. Measuring the effect of changes properly requires testing tools, analytics and enough traffic to reach a reliable result.
• Ongoing maintenance. Each third-party script or integration added to the checkout must be monitored and updated for as long as it stays there.

A sound business case separates the recoverable abandonment described above from the total, applies a realistic share of improvement, and nets out the extra fees and risks. Retailers with low traffic should also be honest about whether they can measure small changes at all. If an A/B test takes months to reach a reliable answer, a more conservative approach based on established usability findings may be better.

Security Rules Now Reach the Payment Page Itself

The Payment Card Industry Data Security Standard (PCI DSS), maintained by the PCI Security Standards Council, governs online card payments in the United States and most other markets. Version 4.0 introduced requirements that took effect after a transition period, and two of them target the checkout directly.

Requirement 6.4.3 requires organizations to maintain an inventory of scripts that run on payment pages, confirm each one is authorized, and protect their integrity so no unauthorized code can be added or altered. Requirement 11.6.1 calls for a mechanism that detects and alerts on unauthorized changes to payment pages. Both became mandatory on March 31, 2025, after being treated as best practice during the transition.

The rules address an attack in which criminals inject code into a checkout page, often through a compromised third-party script, to copy card details as shoppers type them. Because many checkouts load analytics, chat, marketing and personalization tags, the number of scripts on a payment page can grow unnoticed over the years.

What the SAQ A Change Means for Smaller Merchants

Many smaller merchants validate compliance with a short self-assessment questionnaire known as SAQ A, which applies when a payment provider fully outsources card data entry. In early 2025, the Council published an updated SAQ A that removed requirements 6.4.3 and 11.6.1. Instead, it added an eligibility criterion requiring merchants to confirm that their site is not susceptible to script-based attacks that could affect their e-commerce systems.

In practice, a merchant must still assess script security to qualify for the short form. Merchants that cannot confirm the new criterion may need to use SAQ A-EP, a longer questionnaire with substantially more requirements. Any checkout redesign that changes how a payment form is embedded should be reviewed with the merchant’s acquirer or a qualified assessor before launch, since the choice of integration method can move a business from one category to the other.

Price Transparency Has Become a Legal Question

Showing the full price early is good usability practice, and in some sectors it is now also a federal requirement. The Federal Trade Commission’s rule on unfair or deceptive fees took effect on May 12, 2025. It applies to live-event ticketing and short-term lodging, including hotels and vacation rental platforms. It requires businesses to display the total price, including mandatory fees, at the start of the purchase process and more prominently than any partial price.

The rule allows government taxes, shipping and optional add-ons to be excluded from the headline price, but they must still be clearly disclosed before the shopper agrees to pay. The rule doesn’t directly cover retailers outside those two sectors. Still, the FTC may pursue other sectors through enforcement or further rulemaking, and many states have their own consumer protection laws on pricing. TechAmerica.ai covers these questions in its government and policy section.

For checkout teams, the overlap is useful. The same change that reduces abandonment (showing the full cost on the product or cart page instead of revealing fees at the last step) also reduces regulatory exposure. Legal review is still needed because counsel, not designers, decides what counts as a mandatory fee and how prominently it must be shown.

AI Agents Are Starting to Use the Checkout

A newer pressure on checkout design comes from software that shops on a person’s behalf. In late April 2025, Mastercard unveiled Agent Pay and Visa launched its Intelligent Commerce program, both aimed at letting AI agents complete purchases using tokenized credentials, with checks intended to confirm that the cardholder authorizes the agent. Commerce platforms have followed suit, and TechAmerica.ai’s commerce desk has covered Shopify opening checkout to browser-based AI agents with WebMCP support.

This shift raises questions that conventional checkout design never had to answer. If an agent completes a purchase, who confirmed the price, the delivery date and the return terms? How does a merchant tell a legitimate agent from a bot running card-testing attacks? What happens when a shopper disputes a charge and says the agent misunderstood the request? Card issuers are building tools to address this problem, and the commerce section has reported that American Express is introducing Intent Intelligence to prevent unauthorized AI agent purchases.

For most retailers, the near-term effect is modest. Structured product data, clear, machine-readable pricing and delivery information, and reliable order confirmation become more valuable when a checkout page’s reader may be software. A checkout that depends on visual cues alone, or hides key terms behind interactive elements, may serve both human and automated buyers poorly. Standards and liability rules in this area are still forming, so heavy investment in any single protocol carries risk.

Measuring Results and Questions to Ask Vendors

Checkout projects are often judged on a single conversion rate, which can mislead. A cleaner measure tracks completion rate from the start of checkout to a paid order, alongside authorization rate, fraud and chargeback rate, average order value and the share of orders using each payment method. Watching these together shows whether a change added sales or only shifted risk and cost elsewhere.

Seasonality and marketing campaigns can swamp the effect of a checkout change, so comparisons should use controlled tests where traffic allows and like-for-like periods where it does not. Teams should also check results by device, since mobile and desktop shoppers often hit different problems, and by new versus returning customers, who have different tolerance for forms and account prompts.

Questions Worth Asking Before Signing

Vendors selling checkout tools, payment methods or optimization services will present their own performance figures. Those numbers can be useful, but buyers should understand their source. Reasonable questions include:

1. What exactly was measured, over what period, and against what baseline?
2. Were reported gains net of extra fees, fraud losses and chargebacks?
3. Does the product load scripts on the payment page, and how does it support the merchant’s PCI DSS obligations?
4. Which compliance validation route will the integration leave the merchant on?
5. How does the tool handle data from shoppers in different states or countries with different privacy rules?
6. What happens to stored tokens and customer data if the merchant switches providers?
7. How does the product handle orders placed by AI agents, and what controls separate them from automated abuse?

Answers that are vague on any of these points are a signal to slow down. Checkout touches revenue, security, and consumer law, and a vendor that only talks about conversion describes just one part of it.

The most reliable checkout improvements tend to be the least glamorous: honest pricing shown early, fewer fields, guest checkout, familiar payment methods, and a payment page with as few third-party scripts as possible. Larger shifts, from new security rules to AI agents placing orders, will keep changing what a good checkout looks like. Retailers that measure carefully, involve finance and security teams from the start, and treat vendor claims as hypotheses to test will be better placed than those chasing a single headline number. Ongoing reporting on platforms, payments and retail technology is collected in TechAmerica.ai’s commerce section.