Passkeys allow users to log in to their secure accounts without passwords. Ecommerce businesses were first in line when the FIDO Alliance introduced passkeys in 2022. The trade association, which stands for Fast ID Online, launched in 2012 with a mission to reduce the world’s password reliance.
Andrew Shikiar, executive director of FIDO, said the past two years have been momentous for members and ecommerce businesses. “You want to attract customers to your site and protect them from account takeover, credential stuffing, and phishing attacks,” he said. “That’s why PayPal, eBay, Amazon, Walmart, Best Buy, and other ecommerce companies were the earliest adopters of passkey payments.”
Shikiar noted that passkey awareness has risen from 39% in 2022 to 57% in 2024, according to a FIDO survey of 10,000 consumers in the U.S., U.K., France, Germany, Australia, Singapore, Japan, South Korea, India, and China.
Dual Protection
Passkeys protect sign-ins and payments, Shikiar explained, adding, “How do I know that it’s really my customer or a legitimate guest who is signing in or making the purchase and not a fraudster? I want my customers to sign into my site as easily and securely as possible.”
Passkeys leverage public key cryptography, an encryption system involving a public “key” — a large string of numbers used to encrypt data — available to anyone and a private key known only to the user and stored on that user’s device, such as a phone or computer. Only a private key can decrypt a public one. The passkey sign-in process is quick and secure coming from the device storing the private key. Hence a fraudster must have access to a user’s device to sign in to her accounts.
Shikiar stated that sign-in success rates were a hot topic at FIDO’s October 2024 Authenticate conference in California, where Amazon reported a 15% sign-in success increase. Even a 5% sign-in increase is significant for merchants, and higher success rates typically mean sign-ins are faster than passwords and legacy two-factor authentication.
Passkey Readiness
Emily Baxter, a security consultant at RPY Innovations, a payments consultancy, advised merchants to consider internal and external factors when evaluating passkeys. “Merchant readiness could be viewed from two perspectives: the readiness of users and passkey providers,” she said. Essential questions for merchants include how they utilize passwords today, what integrations and vendors are required to enable passkeys, and how customers will experience the change.”
As always, ensure your security team is engaged in assessing your organizational readiness, Baxter added, noting that the best solutions are driven by a clear “why,” which she called the North Star of implementation.
“Your North Star may be a reputation as a safe and trusted merchant or providing an excellent user experience (especially increasing cart abandonment or addressing user frustrations), meeting provider requirements, or it could be something else entirely,” she said.
Baxter pointed out that passwords, despite their shortcomings, can be used anywhere, on any device, and at any time. Merchants must assess the passkey’s potential impact on the user experience by considering:
- Do shoppers typically sign in from their own devices or from, perhaps, public computers?
- Will user adoption of passkeys be voluntary or mandated?
- Will initial implementation require a dual password and passkey solution?
- What customer and employee training and education is necessary?
In addition to referencing FIDO’s Passkey Central, an education portal, Baxter advised merchants to consider how passkeys fit into an overall cybersecurity strategy.
She added that passkeys are configured and shared in different ways. A merchant could implement passkeys directly or via a third-party provider. A user’s private key could reside in, say, an iPhone’s operating system or even a password protection app. And vendors can facilitate any or all of the setup, with varying prices, scalability, and implementation support.
FIDO Certified Vendors
Shikiar agreed, stating that FIDO’s ecosystem has hundreds of certified solution providers that can help ecommerce and other companies implement passkeys quickly.
“We don’t dictate how to develop passkeys or promote vendor-specific solutions,” Shikiar added. “We advise companies to go into vendor discussions with their eyes wide open. Become informed before meeting with a vendor. While these are all FIDO-certified vendors, speaking the same language, having a strategy and clear objectives will help a vendor be more responsive to you and your passkey rollout.”
