The Critical Security Gap: Why Passkeys Remain Underutilized Ahead of the Holiday Shopping Season

The digital landscape is currently undergoing a fundamental transformation in how users verify their identities, yet a significant portion of the global consumer base remains tethered to the antiquated and vulnerable technology of alphanumeric passwords. While the tech industry has spent the last several years championing the "passkey"—a cryptographic replacement for the password that relies on biometric sensors or local device pins—the transition has been slower than cybersecurity experts anticipated. As the retail industry prepares for the massive influx of traffic associated with Black Friday and the broader holiday shopping season, the reliance on traditional passwords presents a growing risk to millions of shoppers.

The concept of the passkey gained significant traction in 2022, when Apple integrated the technology into its ecosystem, effectively bringing password-less authentication to the mainstream. Google and Microsoft swiftly followed, creating a trifecta of industry giants that signaled the beginning of the end for the traditional password. Despite this unified push, a new report from the security platform Dashlane, titled the 2026 Dashlane Passkey Power 20, highlights a stark reality: adoption remains in the double digits, even among the world’s most prominent e-commerce platforms.

The Mechanics of Modern Authentication

To understand the urgency of this transition, one must distinguish between the relative insecurity of passwords and the robustness of FIDO-based passkey authentication. A password, by its very nature, is a shared secret. It exists both on the user’s device and on the company’s server. If a hacker manages to breach a database or trick a user into revealing their password through a phishing campaign, the account is compromised.

Passkeys function on an entirely different architecture. They utilize public-key cryptography, where the "key" never leaves the user’s device. When a user logs in via a biometric scan (such as FaceID or a fingerprint) or a device-specific PIN, the device signs a challenge from the website. Because the private key is bound to the hardware and never transmitted, it is fundamentally resistant to phishing. Even if a user is directed to a fraudulent, lookalike website, the passkey will not "sign" the request because the cryptographic origin does not match the legitimate domain. This eliminates the efficacy of the most common cyber-attack vector in the modern world: the harvesting of stolen credentials through deceptive login portals.

A Chronology of Adoption and Recent Vulnerabilities

The push toward a password-less future was not born in a vacuum; it was a direct response to the escalating sophistication of cybercriminals. Throughout 2023 and 2024, the frequency of credential-stuffing attacks—where hackers use leaked passwords from one breach to gain access to accounts on other services—reached record highs.

The necessity of moving beyond passwords was underscored by a recent high-profile breach involving the fashion retailer ASOS. In this incident, unauthorized actors managed to bypass traditional security measures not by cracking complex code, but by leveraging human fallibility. By impersonating a trusted contact, the attackers gained access to an internal employee account. This event, which resulted in the hackers publicly notifying the company of the breach via their own platform, serves as a poignant case study. Had the authentication process been strictly governed by hardware-backed passkeys, the impersonation of a contact would likely have failed to provide the necessary cryptographic verification to access the internal system.

Data Trends: The 2026 Dashlane Passkey Power 20

The data provided by Dashlane, derived from millions of anonymized authentications between July 2025 and June 2026, paints a sobering picture of current digital habits. Despite the security benefits, the adoption rates among major retail platforms are surprisingly low:

• Google: 28% adoption rate
• PayPal: 18% adoption rate
• Amazon: 17% adoption rate
• eBay: 8% adoption rate

These figures suggest that while the infrastructure for passkeys is largely in place, the user experience hurdle—getting consumers to switch their existing settings—remains the primary bottleneck. For an organization like Amazon, which handles a significant portion of global e-commerce, an 83% reliance on traditional passwords during the height of the holiday season represents a massive attack surface.

The Holiday Risk Factor

The timing of this data release is critical. As the retail sector moves toward Black Friday and Cyber Monday, the volume of login attempts increases exponentially. Historical data from sources such as Adobe Analytics indicates that online spending during the Black Friday weekend routinely exceeds $12 billion in the United States alone.

Cybercriminals are acutely aware of this cycle. The holiday rush is characterized by "urgency-based" shopping behavior, where consumers are more likely to ignore red flags, such as suspicious URLs or unusual login prompts, in their haste to secure limited-time deals. Christophe Frenet, chief product officer at Dashlane, emphasizes that this environment is a perfect storm for threat actors. "Black Friday brings a rush of offers, purchases, and account logins, but it also means an increase in cybercriminal activity," Frenet stated. "Shoppers want to get on with buying, without struggling to remember passwords or worrying about whether a sign-in page is genuine."

Implications for Retailers and Consumers

The burden of adoption does not rest solely on the consumer. While individuals are responsible for enabling passkeys, retailers are responsible for the user interface that makes such a transition intuitive. Experts argue that if the "Sign in with Passkey" button is buried deep within security settings, the average user will never bother to find it.

Retailers face a complex dilemma: they must balance security with friction-less conversion. A checkout process that is too difficult will lead to cart abandonment. However, a breach of customer data can lead to long-term reputational damage and legal liabilities that far outweigh the temporary friction of moving users toward more secure login methods.

The industry-wide analysis suggests that retailers need to move beyond simply "offering" passkeys as an alternative. Proactive measures, such as providing tutorials during the account setup process or offering small loyalty incentives for users who switch to biometric authentication, could accelerate the necessary shift.

The Path Forward: Beyond the Password

The broader implication of the current passkey adoption trend is that the digital economy is currently living on borrowed time. As AI-driven phishing becomes more convincing—capable of generating realistic voice clones and perfect website replicas—the reliance on human memory and static secrets like passwords is no longer a viable security strategy.

The shift to passkeys is not merely a technological upgrade; it is a fundamental re-architecting of trust on the internet. While the 2026 statistics show that the majority of users remain in the "password-heavy" category, the trajectory is moving toward a decline in reliance on passwords. The challenge for the coming year is to ensure that this transition happens fast enough to mitigate the risks posed by increasingly professionalized cybercrime syndicates.

As the retail industry approaches the end of the year, both platform operators and consumers must recognize that security is an active responsibility. For retailers, the focus must be on usability and accessibility. For consumers, the message is clear: enabling a passkey is perhaps the single most effective action one can take to protect financial and personal data during the upcoming shopping season. The technology is ready, the infrastructure is live, and the need for a more secure internet has never been more pressing. The question remains whether the retail ecosystem can incentivize a shift in behavior before the next major wave of credential-based attacks hits the marketplace.