If one or more of your funnel steps are defined as URLs from another domain or subdomain, and your tracking code isn't customized for cross-domain tracking, users will appear to drop out of the funnel.
For example, suppose you set up your funnel as follows:
Goal URL: example.com/jkl.html
Funnel Steps:
Step 1 (Required step): example.com/abc.html
Step 2: example.com/def.html
Step 3: example.org/ghi.html
If the tracking code has not been customized for cross-domain tracking, users appear to drop off at Step 2. This is because a new session is created when the user goes from example.com/def.html to example.org/ghi.html. In the new session, Analytics has no knowledge of the user having completed Step 1 because it was done in the previous session. As a result, there is no data to indicate that the user converted the goal.