Passkeys at Checkout: A Fashion Retailer's Returning-Buyer Experiment
An online fashion retailer replaced password and one-time-code sign-in with passkeys for returning buyers. The experiment changed conversion, support volume and account-takeover rates.
A mid-sized European fashion retailer using Loomcart's headless checkout noticed that returning buyers abandoned at an unusually high rate at one step: signing in. Forgotten passwords, delayed one-time codes and password-reset loops were costing sales, and credential-stuffing attacks were driving account-takeover losses.
The experiment
The retailer offered passkey creation to returning buyers after a successful sign-in, and then split subsequent traffic: half saw passkey sign-in as the default, half saw the existing password flow. Passkeys use the FIDO2 and WebAuthn standards, so the buyer authenticates with the device's biometric or screen lock, and the private key never leaves the device or its synchronized credential manager.
What happened
Buyers who used a passkey completed sign-in considerably faster than those using a password, and the passkey group's checkout conversion was higher across the test period. Password-reset support tickets declined as passkey adoption grew. Account-takeover attempts against passkey-enabled accounts were largely ineffective, because there was no password to stuff and no code to phish.
Pitfalls
Two issues needed work. Recovery was the first: buyers who changed phones without a synchronized credential manager needed a safe fallback, and the retailer chose email-based recovery with added risk checks rather than reverting to SMS codes. The second was messaging. Early copy that used the word "passkey" alone confused some buyers, while copy that explained "sign in with your face or fingerprint" performed better.
Next steps
The retailer is now exploring whether passkey authentication at checkout can also satisfy strong customer authentication requirements for card payments through issuer-supported schemes, which would remove a second authentication step for many buyers.
More from the library
Injection Attacks and the Next Phase of Remote Identity Verification
Presentation attacks put something fake in front of the camera. Injection attacks skip the camera entirely. This paper explains the difference and the layered defenses onboarding teams need.
Beyond the PAN: Network Tokens, 3DS2 and the Authorization-Rate Playbook
A practical session on moving card-not-present volume onto network tokens, using SCA exemptions responsibly, and reading authorization data by issuer.
From Open Banking to Open Finance: What PSD3 and the PSR Mean for Your Roadmap
Tributary's regulatory and product leads unpack the EU payments package, API performance expectations, and how the US data-rights debate is shaping product plans.