Passkeys for E-commerce: A Game Changer Part 2

In the last blog post, we covered the frustration of password management for users and how it has become a universal experience. Specifically, we covered why passwords are a problem, passkeys and their passwordless experience, and finally recommendations on the strategies required to make the move from passwords to passkeys.

In this blog, we will continue the conversation to provide a better view of what delivering a passkey-based passwordless experience requires and the benefits it will ultimately provide.

Implementation Considerations for Passkeys in E-Commerce

When rolling out passkeys for authentication in e-commerce, organizations must take a holistic approach that addresses technical, user experience, and platform-specific factors to ensure both security and adoption.

Use Cases

Passkeys should be strategically integrated into key user journeys where security and convenience are paramount. This includes not only sign-in and onboarding experiences but also high-security activities such as changing delivery addresses or redeeming loyalty points, and especially payment authentication. By targeting these critical touchpoints, e-commerce platforms can maximize the impact of passkeys, streamlining processes while significantly reducing the risk of account takeover and fraud. Leading retailers like Amazon and eBay have already demonstrated the value of passkeys in these scenarios, setting new standards for secure and seamless customer interactions.

User Experience

A successful passkey implementation hinges on user education and thoughtful UX design. Users should be primed about what to expect when encountering passkeys, with clear, reassuring messaging that explains the benefits, such as faster logins, enhanced security, and protection from phishing. Testing different messaging approaches is essential to identify what resonates and reduces confusion, especially since passkeys represent a shift from familiar password-based flows. Educational prompts, visual cues, and step-by-step guidance can help users understand and trust the new system, minimizing abandonment during onboarding or authentication. Ultimately, a seamless and intuitive experience will drive adoption and satisfaction.

Platform Support

E-commerce organizations must ensure robust support across all major platforms: iOS, Android, and web applications, while accounting for the diverse device combinations their customers use (e.g., iPhone with Windows PC). This includes providing a consistent experience for both new and existing users, regardless of their device ecosystem. Technical challenges such as cross-device authentication, account recovery, and syncing passkeys across platforms must be addressed to avoid friction and ensure reliability. Leveraging established passkey providers or APIs can simplify these complexities, enabling faster deployment and higher adoption rates while maintaining security and compliance.

Best Practices

Based on experiences with numerous global deployments, here are the key lessons we have learned:

1. Delight Your Users
   • Only offer passkeys when practical on specific devices
   • Actively suggest passkey creation rather than waiting for users to discover the option
   • Be mindful of users accustomed to seamless experiences in mobile apps
2. Simplify Implementation
   • Use SDKs with consistent APIs across platforms
   • Employ headless widgets to reduce code complexity
   • Design authentication rules that can be changed without app updates
3. Enhance Security
   • Verify user identity before allowing passkey creation
   • Consider risk scenarios (particularly for high-value features)
   • Protect against denial-of-service attacks

Getting Started

Passkeys are already being used by many companies globally, including large retailers. Users have experienced their benefits through accounts with Apple, Google, Microsoft, and Amazon.

As part of OneSpan, Nok Nok stands out in the authentication market by delivering a secure, scalable, and customizable passwordless authentication platform that addresses the challenges of modern digital security. As a founding member of the FIDO Alliance and a key contributor to passkey standards, our technology enables organizations to eliminate passwords, reducing the risk of phishing, account takeovers, and other cyberattacks. The platform supports seamless integration with existing systems, offers flexible deployment options (on-premise or cloud), and provides adaptive authentication that adjusts security measures based on real-time risk signals like device health and location. This approach not only strengthens security but also streamlines user experiences, leading to faster sign-ups, higher authentication success rates, and significant reductions in account recovery requests and operational costs.

Together, OneSpan and Nok Nok, we are proud that our advanced authentication technology is trusted by some of the world’s largest brands, including leading banks and mobile network operators. Our platform is purpose-built to handle internet-scale deployments with zero downtime, supporting all major devices and operating systems. With developer-friendly SDKs and prebuilt authenticator apps, we make it easy for organizations to modernize authentication across a wide range of use cases and user populations, all while reducing development and maintenance costs.

The right technology partner can make implementation easier. Look for solutions that offer:

• Intelligent credential detection
• Quick authentication with minimal latency
• Flexible support for multiple authentication methods
• Transparent migration from legacy biometrics
• Industry benchmarks for comparison
• Granular adaptive policies
• Detailed analytics and audit trails

Conclusion

Passkeys represent a genuine game-changer for e-commerce authentication. By offering a more convenient, secure, and consistent user experience across all digital channels, they address the fundamental problems of password-based systems while providing measurable business benefits.

The technology is mature, widely supported, and ready for adoption. For e-commerce businesses looking to improve conversion rates, enhance security, and reduce operational costs, the time to implement passkeys is now.

Passkeys for E-commerce: A Game Changer Part 1

In today’s digital landscape, the frustration of password management for users has become a universal experience. Whether you’re trying to read an online magazine or make a purchase, being prompted for a password you can’t remember is a common pain point that affects both users and businesses.

The Problem with Passwords

Password technology is 50+ years-old, and we still rely on it today, creating real business challenges:

• Revenue Impact: Users avoid creating new accounts when prompted for passwords, with 25% abandoning account creation entirely. On mobile devices, the problem is even worse, with 20% more guest checkouts compared to desktop.
• Security Vulnerabilities: Passwords remain the number one source of breaches due to phishing, man-in-the-middle attacks, and server-side credential stealing, all of which damage brand reputation.
• Operational Costs: Up to 80% of users recover their accounts annually, creating unnecessary support costs and user frustration.

The experience passwords deliver is frustrating for end users and provides little security when protecting data, applications, and services. Layering on two-factor authentication or multi-factor authentication has only complicated the experience, and hackers are finding ways around them. But what is the alternative?

Enter Passkeys: The Passwordless Solution

Passkeys represent a revolutionary approach to authentication that solves these problems by leveraging cryptography, biometrics, and native device support. As a FIDO-based standard endorsed by major tech companies and regulatory bodies, passkeys are becoming mainstream, with 75% of consumers already aware of them (a 75% increase since 2022).

Key Benefits for E-commerce

1. Improved User Experience

• 10-20% increase in account creation success
• 2-17x faster sign-in times
• 6x better sign-in success rates
• 65-99% reduction in account recovery needs

1. Enhanced Security

• Phishing-resistant authentication
• Protection against server-side credential theft
• No shared biometric data (GDPR-friendly)

1. Cross-Platform Consistency

• Create one passkey and use it across web and mobile apps
• Works seamlessly across multiple devices (smartphones, tablets, laptops)
• Syncs through platform providers like Apple, Google, and Microsoft

Implementation Strategy

Phase 1: Planning and Early Adoption

The journey to passkey authentication in e-commerce begins with thoughtful planning and an early adoption phase. Here, organizations must clearly define the use cases where passkeys will deliver the most value, such as streamlining checkout or securing account management, and identify the target user groups most likely to benefit from a passwordless experience. Establishing key performance indicators (KPIs) is essential to measure success, whether it’s reduced login friction, increased conversion rates, or improved security metrics. During this phase, it’s critical to allow users to opt into passkeys rather than mandating the change, ensuring a smooth transition and minimizing resistance. By closely monitoring adoption rates and gathering user feedback, organizations can iterate on the experience, address pain points, and build trust in this new authentication paradigm.

Phase 2: Incentivizing Adoption

Once the foundation is set, the next phase focuses on accelerating adoption by actively incentivizing users. E-commerce organizations can offer tangible rewards, such as loyalty points or exclusive discounts, for customers who create and use passkeys, turning security into a value-added proposition. Proactive prompts and clear messaging should encourage users to set up passkeys, highlighting the benefits of speed, convenience, and enhanced protection against phishing. For new users, the onboarding process can be made passwordless from the outset, eliminating legacy friction and setting a new standard for account creation. This phase is about making passkeys not just available, but desirable, leveraging both behavioral nudges and direct incentives to drive widespread uptake.

Phase 3: Password Deprecation

With strong adoption in place, organizations can move toward the final phase: password deprecation. At this stage, passkeys become the default—and eventually the required—authentication method for all new users, ensuring that the next generation of customers never needs to create or remember a password. For existing users, a gradual migration strategy is key: targeted communications, in-app prompts, and support resources can help guide them through the transition. High-security features, such as account recovery or payment management, can be made passkey-only to further reduce risk and reinforce the new standard. By phasing out passwords, e-commerce organizations not only enhance security but also deliver a seamless, modern user experience that sets them apart in a competitive market.

In the next blog, we’ll continue this discussion by covering important implementation considerations, some best practices based on our experiences, and finally, how to get started on this journey.