In the rapidly evolving landscape of cybersecurity, a significant disconnect has emerged between the availability of advanced authentication technology and its actual implementation by consumers. As the global retail industry prepares for the unprecedented surge of Black Friday and Cyber Monday, new data suggests that the vast majority of shoppers remain tethered to vulnerable, legacy password systems.
Despite the introduction of "passkeys"—a cryptographic alternative to traditional passwords—adoption rates among the world’s largest e-commerce platforms remain strikingly low. This vulnerability is highlighted by recent security breaches at major retailers and a comprehensive new report from Dashlane, which indicates that even industry leaders like Amazon and eBay are seeing only a fraction of their users transition to more secure login methods.
Main Facts: The State of Passkey Adoption in 2025-2026
The transition to a password-less future was intended to eliminate the primary vector for cyberattacks: the stolen or phished credential. However, the "2026 Dashlane Passkey Power 20" report reveals a sobering reality. Based on an analysis of millions of anonymized authentications between July 2025 and June 2026, the report highlights that the convenience of passkeys has not yet translated into universal habit.
According to the findings, Google leads the pack with a 28 percent passkey adoption rate, likely due to its aggressive prompting and seamless integration across Android and Chrome ecosystems. However, the retail sector lags significantly behind:
- Amazon: Only 17 percent of logins utilized passkeys.
- PayPal: Despite being a high-stakes financial gateway, only 18 percent of users have made the switch.
- eBay: Adoption sits at a meager 8 percent.
These figures are particularly concerning given the sheer volume of capital at risk. During the previous year’s Black Friday, Adobe estimated that online sales reached nearly $12 billion. With billions of dollars flowing through digital storefronts in a matter of 48 hours, the reliance on traditional passwords creates a massive "attack surface" for cybercriminals who specialize in credential stuffing and phishing.
Chronology: From Innovation to the Current Crisis
To understand the current impasse, one must look at the timeline of passkey development and the subsequent rise in sophisticated social engineering attacks.
2022: The Birth of a New Standard
The term "passkey" entered the mainstream consciousness in 2022 when Apple integrated the feature into iOS and macOS. Built on the FIDO (Fast IDentity Online) Alliance standards, the technology was designed to replace the "shared secret" model of passwords with a "public-private key" pair. Soon after Apple’s launch, Google and Microsoft followed suit, creating a unified front among the "Big Three" of tech to kill the password.
2023-2024: The Integration Phase
Throughout 2023 and 2024, major platforms began rolling out support. Amazon and PayPal introduced passkey options for their mobile apps and web interfaces. During this period, the narrative among security experts was optimistic; it was believed that the elimination of "password fatigue" would lead to a rapid migration.
2025-2026: The Adoption Plateau and the ASOS Incident
By mid-2025, the technology was mature, yet as the Dashlane report indicates, the majority of users remained stagnant. This period of low adoption coincided with increasingly brazen cyberattacks.
The most recent high-profile example occurred with the London-based fashion giant, ASOS. In a move that shocked the retail industry, hackers gained access to the ASOS internal systems not through a complex "brute force" attack on the server, but through a simple social engineering exploit. The hackers themselves announced the breach by posting a notification within the ASOS app, declaring the brand had been "hacked."
ASOS later confirmed that an unauthorized party gained access to an employee account by impersonating a trusted contact. This specific type of attack—impersonation to obtain login credentials—is exactly what passkeys are designed to prevent.
Supporting Data: The Mechanics of the Threat
The vulnerability of the current retail landscape is rooted in the technical limitations of passwords compared to the cryptographic strength of passkeys.
The Phishing Problem
Phishing remains the most common cyberattack globally. It involves a malicious actor impersonating a legitimate entity to trick a user into revealing their password. Because a password is a piece of information that can be written down or typed into a fake website, it is inherently "phishable."
In contrast, a passkey consists of two parts:
- A Public Key: Stored on the website’s server (e.g., Amazon’s server).
- A Private Key: Stored locally on the user’s device (e.g., an iPhone or a security key) and protected by biometrics like FaceID or a fingerprint.
During login, the server sends a "challenge" that can only be signed by the private key on the user’s physical device. Because the private key never leaves the device and the authentication is tied to the specific domain of the website, it is nearly impossible for a hacker to intercept or spoof the login process.
The Financial Stakes of Black Friday
The Dashlane report emphasizes that the "Christmas shopping rush" acts as a catalyst for criminal activity. Last year’s $12 billion Black Friday spend provided a massive incentive for hackers. When 83 percent of Amazon users and 92 percent of eBay users are still using passwords, the potential for "account takeover" (ATO) fraud is immense.
ATO fraud doesn’t just result in direct financial loss for the consumer; it leads to massive operational costs for retailers who must handle disputed charges, identity restoration, and the loss of brand reputation.
Official Responses: Industry Leaders Call for Action
The data has prompted urgent calls from security professionals for retailers to do more than just "offer" passkeys; they must actively drive adoption.
Christophe Frenet, Chief Product Officer at Dashlane, highlighted the tension between consumer convenience and security. "Black Friday brings a rush of offers, purchases, and account logins, but it also means an increase in cybercriminal activity," Frenet stated. "Shoppers want to get on with buying, without struggling to remember passwords or worrying about whether a sign-in page is genuine."
Frenet argues that the responsibility now lies with the platforms. "Passkeys make signing in simpler while protecting against phishing and stolen-password attacks. Retailers need to make that safer option easier to find and use, especially as we head into the Christmas shopping rush. Offering it is a start, but getting customers to adopt it is what matters."
The response from ASOS regarding their recent breach served as a grim validation of Frenet’s concerns. In a public note, ASOS admitted that the breach was a result of an "unauthorized party" obtaining credentials via impersonation. This admission underscores a critical point: even if a company has robust backend security, the "human element"—the use of phishable passwords by employees and customers alike—remains the weakest link.
Implications: The Future of Digital Trust
The low adoption rates of passkeys have profound implications for the future of e-commerce and digital identity.
1. The Erosion of Consumer Trust
As evidenced by the ASOS hack, a breach can be highly visible and damaging to a brand’s image. If consumers feel that their data is not safe, they may retreat to larger, more "secure" ecosystems like Google or Apple Pay, potentially squeezing out independent retailers who cannot convince their users to adopt better security habits.
2. The Shift Toward "Incentivized Security"
Experts predict that retailers may soon begin incentivizing the use of passkeys. This could take the form of small discounts, faster checkout lanes, or enhanced fraud protection for accounts that utilize cryptographic authentication. Much like insurance companies offer lower premiums for homes with security systems, e-commerce sites may offer "security rewards" to mitigate the high cost of fraud.
3. The Need for "Default" Security
The Dashlane data suggests that simply making a feature available is not enough. For passkeys to become the standard, platforms may need to move toward a "passkey-first" onboarding process. This would involve prompting new users to create a passkey during account setup and nudging existing users to "upgrade" their security during the high-traffic holiday season.
4. Protecting the Workforce
The ASOS incident proves that passkey adoption must also happen internally. Enterprise security is just as vulnerable to phishing as consumer accounts. For large retailers, the mandate is clear: transitioning employees to hardware-backed passkeys is no longer an optional "IT project"—it is a business necessity to prevent the kind of brand-damaging notifications seen in the ASOS app.
Conclusion
As the retail world enters its most profitable—and most dangerous—quarter, the "2026 Dashlane Passkey Power 20" report serves as a wake-up call. The technology to virtually eliminate phishing exists and is already in the pockets of millions of consumers. Yet, the 17 percent adoption rate at Amazon and 8 percent at eBay represent a significant gap in the digital armor of the global economy.
The move from passwords to passkeys is not merely a technical upgrade; it is a cultural shift. Until retailers prioritize user education and streamline the adoption process, the annual "rush of offers" will continue to be accompanied by a "rush of breaches," leaving both businesses and consumers at the mercy of increasingly sophisticated cybercriminals.
