The idea of passkeys is fairly new.

It was Apple that popularized the term when it launched the password-less log-in feature in 2022. Google and Microsoft followed suit soon after, further propelling the log-in method into the mainstream consciousness.

On the surface, a passkey looks simple because it just requires biometrics or a pin to open. Underneath, however, it uses cryptography to authenticate the user, making it nearly impossible to phish. Phishing, one of the the most common cyber-attacks in the world, is when sensitive data is acquired by impersonating a legitimate business or a trusted person.

Passkeys are widely recognized as the most secure and simple way to access an account. The problem is that most people still use passwords.

The implications are worrying, especially when considering the fact that Black Friday and Cyber Monday are fast approaching. It’s a time when throngs of consumers look to the web for deals. On Black Friday last year, Adobe estimated nearly $12 billion came from online sales.

Most shoppers in eBay and Amazon don’t use passkeys, according to a new report from Dashlane, a London-based password management and credential security platform that has been tracking the growing but still relatively small use of passkeys.

According to the report, only 17 percent of log-ins on Amazon, the world’s largest online marketplace, were passkeys. EBay, on the other hand had eight percent, while Paypal had 18 percent. The largest share goes to Google with 28 percent.

Called the 2026 Dashlane Passkey Power 20 report, it was based on an analysis of Dashlane data covering millions of aggregated and anonymized web and mobile passkey authentications globally from July 2025 through June 2026.

“Black Friday brings a rush of offers, purchases and account logins but it also means an increase in cybercriminal activity. Shoppers want to get on with buying, without struggling to remember passwords or worrying about whether a sign-in page is genuine,” said Christophe Frenet, chief product officer at Dashlane.

“Passkeys make signing in simpler while protecting against phishing and stolen-password attacks. Retailers need to make that safer option easier to find and use, especially as we head into the Christmas shopping rush. Offering it is a start but getting customers to adopt it is what matters,” he said.

The report comes on the heels of a cyber-attack on London-based fashion brand and retailer Asos. The hack was announced by the hackers themselves, who managed to gain access to the app and post a public notification that essentially said Asos was “hacked.”

Asos explained in a public note on its website that it discovered than an “an unauthorized party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials.”