---
url: 'https://www.corbado.com/blog/disable-passwords-case-studies-authenticate-2026'
title: 'Disable Passwords: Real Case Data from 2026'
description: 'How Mercari, Meta, PayPal, Capital One and GM remove passwords and go passwordless. Authenticate 2026 case data, incl. Mercari cutting password reliance from 75% to 22%.'
lang: 'en'
author: 'Vincent Delitz'
date: '2026-10-29T13:48:36.648Z'
lastModified: '2026-10-31T07:00:27.958Z'
keywords: 'remove passwords, passwordless accounts, go passwordless, disable passwords, password removal case studies, passkey mandate'
category: 'Authentication'
---

# Disable Passwords: Real Case Data from 2026

## Key Facts

- The FIDO Passkey Index 2026 found that **9 of 13 relying parties plan passwordless
  accounts within 12 months**.
- Mercari cut **password reliance at login from 75% to 22%** in three years, while
  passkeys reached 41.2% of logins and login success rose by 13 points between January and
  September 2026.
- After Mercari removed the password step from sign-up, **password sign-ups fell from
  about half of new users to about 1%**.
- At Passkey Index participants, **36% of successful sign-ins use a passkey**, up from 26%
  in 2025.
- Passkey sign-ins **succeed 93% of the time vs. 78%** for passwords and traditional MFA,
  according to the FIDO Passkey Index 2026.
- Since August 2026, Meta has been **requiring passkey creation for users tied to ad
  business portfolios**, with a grace period of 14 to 30 days.
- General Motors enabled **passwordless, phishing-resistant authentication for more than
  200,000 workforce users** in 19 rollout waves.

## 1. Introduction

Removing passwords has moved from roadmap slide to production. At
[Authenticate 2026](https://www.corbado.com/blog/android-restore-credentials-zero-tap-sign-in), Mercari reported
that password reliance at login fell from 75% to 22% after it removed passwords from
sign-up, login and recovery. The FIDO
[Passkey Index 2026](https://www.corbado.com/blog/passkey-index-2026-enrollment-vs-usage) found that 9 of 13
participating relying parties plan passwordless accounts within the next 12 months.
Passkey sign-ins now make up 36% of successful sign-ins at Index participants. This recap
collects what Mercari, Meta, [PayPal](https://www.corbado.com/blog/paypal-passkeys), Capital One,
[eBay](https://www.corbado.com/blog/ebay-passkeys), Microsoft and General Motors shared about actually removing
passwords, including the rules, guardrails and remaining gaps.

## 2. How many Companies plan Passwordless Accounts in 2026 and 2027?

Most large consumer relying parties now plan to remove passwords for at least part of
their user base. The FIDO
[Passkey Index 2026](https://www.corbado.com/blog/passkey-index-2026-enrollment-vs-usage), presented by Diego
Zavala (Director of Ecosystem Development, [FIDO Alliance](https://www.corbado.com/glossary/fido-alliance)),
found that 9 of 13 respondents plan passwordless accounts within 12 months. One of them
plans it on an exploratory basis, one is researching and three have no plans yet.

The Index draws on confidential, unweighted data from 15 large consumer relying parties.
No figure is attributed to a single organization, so the Index does not reveal which
participants plan passwordless accounts. The 15 participants are Abanca, Amazon, Banesco,
CVS, Google, JP Morgan Chase, KDDI, LY Corporation, Mercari, Microsoft, NTT DOCOMO,
[PayPal](https://www.corbado.com/blog/paypal-passkeys), [Shopify](https://www.corbado.com/blog/shopify-passkeys),
[TikTok](https://www.corbado.com/blog/tiktok-passkeys) and [WhatsApp](https://www.corbado.com/blog/whatsapp-passkeys).

![The 15 consumer relying parties behind the FIDO Passkey Index 2026](https://www.corbado.com/website-assets/authenticate_2026_fido_passkey_index_participants_e9a45ce6cc.jpg)

_Source: Diego Zavala (FIDO Alliance), Authenticate 2026_

Zavala gave two reasons for passwordless accounts: they remove phishable fallbacks and
they ensure users actually use the passkey they already have. Usage data supports the
move. Passkeys account for 36% of successful sign-ins, up from 26% in 2025. Passkey
sign-in success is 93% vs. 78% for passwords and MFA, and passkey sign-in is 2.8x faster.
We break down these numbers in our
[Passkey Index 2026 analysis](https://www.corbado.com/blog/passkey-index-2026-enrollment-vs-usage), and the full
report is available from the [FIDO Alliance](https://www.corbado.com/glossary/fido-alliance).

[Dashlane's](https://www.corbado.com/blog/dashlane-passkeys) Rew Islam and Tina Zhuo added an outside view: 40%
of the top 1,000 relying parties by authentication volume support passkeys in 2026. In a
sample of the top 60, only a handful see more than about 16% of authentications on
passkeys. Their advice is to publish a password phase-out date. They cited HubSpot's goal
to be fully passwordless by 2027.

## 3. How did Mercari remove Passwords from Sign-up, Login and Recovery?

Mercari removed passwords in all three places where they live: registration, login and
recovery. Tatsuya Karino (Engineer, Mercari) explained at
[Authenticate 2026](https://www.corbado.com/blog/android-restore-credentials-zero-tap-sign-in) that 14 million
passkey users were not enough, because attackers simply targeted the remaining password or
email link. Mercari runs one account across its [marketplace](https://www.corbado.com/passkeys-for-e-commerce),
the Merpay [payment](https://www.corbado.com/passkeys-for-payment) service and the Mercoin crypto exchange.

![Mercari removes passwords at registration, login and recovery](https://www.corbado.com/website-assets/authenticate_2026_mercari_kill_the_password_fcb90ccd3c.jpg)

_Source: Tatsuya Karino (Mercari), Authenticate 2026_

### 3.1 Sign-up without a Password

Mercari changed sign-up in two steps. First,
[passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) became the primary option, with
a small "register with password" link. Then a feature flag removed the password step
entirely. Passkeys stay skippable, because some users cannot create one. Password sign-ups
fell from about half of new users to about 1%.

![Mercari sign-up flow in which no password is created and passkey registration stays optional](https://www.corbado.com/website-assets/authenticate_2026_mercari_signup_without_password_9b20b40250.jpg)

_Source: Tatsuya Karino (Mercari), Authenticate 2026_

### 3.2 Per-user Password Disabling at Login

Mercari replaced its login menu with an
[identifier-first flow](https://www.corbado.com/faq/identifier-first-approach-passkey-login) that offers one
factor at a time. This lets Mercari decide per account which factors to allow:

- **A registered passkey disables the password:** Once a user creates a passkey, the
  password stops working for that account.
- **A risky environment blocks the password for that login:** A high risk score, for
  example from a residential proxy or VPN, removes the password option.
- **Detected account takeover revokes the password:** ATO detection ends the session and
  invalidates the password.
- **Automatic upgrades remove the password too:** A password login via a
  [password manager](https://www.corbado.com/blog/passkeys-vs-password-managers) can
  [create a passkey](https://www.corbado.com/blog/passkey-creation-best-practices) through
  [conditional create](https://www.corbado.com/blog/conditional-create-passkeys), which then removes the
  password.

![Mercari login factor share since 2023 with 78.1% of logins without a password in August 2026](https://www.corbado.com/website-assets/authenticate_2026_mercari_passwordless_login_share_e76fb02e93.jpg)

_Source: Tatsuya Karino (Mercari), Authenticate 2026_

Results after three years: password reliance fell from 75% to 22%, passkeys reached 41.2%
and login success rose by 13 points between January and September 2026.

![Mercari identifier-first login that offers passkey, social login, password and email link as a prioritized fallback](https://www.corbado.com/website-assets/authenticate_2026_mercari_identifier_first_login_c869b0bf21.jpg)

_Source: Tatsuya Karino (Mercari), Authenticate 2026_

Corbado's [Passkey Benchmark 2026](https://www.corbado.com/blog/world-passkey-day-passkey-benchmark-2026) shows
why the password option itself matters: with a simple post-login nudge, about 25% of
passkey-ready users enroll, but only about 20% of their logins use the passkey because the
login screen still offers the password. Passkey-first return flows reach 95% usage
([Passkey Benchmark 2026](https://www.corbado.com/blog/world-passkey-day-passkey-benchmark-2026)).

### 3.3 Recovery without Password Reset

Mercari replaced email-link
[password resets](https://www.corbado.com/faq/passkeys-reduce-password-resets-otp-costs) with
[identity proofing](https://www.corbado.com/blog/digital-identity-guide) via ID document plus selfie or the My
Number Card. Recovery no longer offers a password and disables any existing one.

## 4. Why has Meta not removed Passwords yet?

Meta has not removed passwords yet because it wants to be sure no user loses access first.
Jason Cheung (Product Marketing Manager, Meta) said at
[Authenticate 2026](https://www.corbado.com/blog/android-restore-credentials-zero-tap-sign-in) that Meta uses
signals such as an available recovery method or a second secure method, like a registered
[security key](https://www.corbado.com/glossary/security-key). Meta has created more than 100 million Meta
account passkeys since it started in January 2026.

Alistair Thornton (Director, Product Management, Meta) described the sequence Meta
follows:

1. **Every user gets a passkey:** Creation comes first.
2. **The passkey is used in all relevant flows:** Login,
   [2FA](https://www.corbado.com/blog/psd2-passkeys/are-passkeys-two-factor-authentication) and reauthentication
   default to it.
3. **Users can get back in if they lose it:** Recovery has to work without the password.
4. **Password logins get harder for passkey holders:** Meta adds friction to non-passkey
   methods.
5. **The password is switched off last:** Removal follows once that balance is right.

With "passkey fortification", Meta already goes a step further for some users. For
consistent passkey users, Meta is testing and rolling out the removal of phishable methods
at [2FA](https://www.corbado.com/blog/psd2-passkeys/are-passkeys-two-factor-authentication), login challenges,
certain reauth flows and recovery. Thornton also said Meta wants to start experimenting
with passwordless registration for new accounts, with the caveat that it must work for 3
billion users.

Since August 2026, Meta has also been rolling out required
[passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) for users tied to ad business
portfolios. What worked: a large optional base first, a grace period of 14 to 30 days with
repeated warnings, briefed support and sales teams and close monitoring. Problems came
from confusion about OS requirements and enterprise IT blocking
[Google Password Manager](https://www.corbado.com/blog/how-to-use-google-password-manager) or
[iCloud Keychain](https://www.corbado.com/glossary/icloud-keychain). Despite these issues, Cheung called
mandatory [passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) "relatively low
friction" overall. More on Meta's earlier rollout is in our
[Facebook passkeys analysis](https://www.corbado.com/blog/facebook-passkeys).

## 5. How does PayPal plan to remove phishable Fallbacks?

[PayPal](https://www.corbado.com/blog/paypal-passkeys) shows that passkeys alone do not stop account takeovers
while phishable fallbacks stay on the account. Rakan Khalid (Sr. Director, Identity
Product Management, PayPal) said at Authenticate 2026 that PayPal sees no evidence of
[phishing](https://www.corbado.com/glossary/phishing) among customers who log in with a passkey. Its next step is
to test access with [phishing](https://www.corbado.com/glossary/phishing)-resistant
[authenticators](https://www.corbado.com/glossary/authenticator) only.

Takeovers still happen through SMS OTP and password fallbacks, after which attackers
create passkeys in their own password managers. PayPal planned to test a scenario with no
phishable [authenticator](https://www.corbado.com/glossary/authenticator) at all "in the next few weeks" after
the October 2026 conference.

[PayPal's](https://www.corbado.com/blog/paypal-passkeys) best opt-in entry point is
[password reset](https://www.corbado.com/blog/password-reset-increase-customer-retention), while checkout brings
volume. About 30% to 40% of users who see the checkout prompt try to enroll, and PayPal
accepted some drop-off based on a break-even analysis. Khalid named a three- to four-month
payback as an example of an acceptable break-even. Our
[PayPal passkeys analysis](https://www.corbado.com/blog/paypal-passkeys) shows how the login flow looks in
practice.

## 6. How did Capital One reduce Password Reliance step by step?

Capital One reduced password reliance in three steps: no passwords for everyday sign-in,
no password at enrollment and weaning existing customers off passwords. Dhaval Shah
(Director of Product, Identity, Capital One) said at Authenticate 2026 that passkey usage
on web rose from 12% to 65%. Moving passkey registration into
[account opening](https://www.corbado.com/blog/digital-identity-verification) doubled registrations.

![Capital One web sign-ins where passkey usage rose from 12% to 65% and overtook passwords](https://www.corbado.com/website-assets/authenticate_2026_capital_one_passkey_usage_web_e7b5f33a87.jpg)

_Source: Dhaval Shah and Sujeet Sinha (Capital One), Authenticate 2026_

The usage jump came from the login screen. Capital One hid "Sign in with passkey" for
users without a passkey and added [Conditional UI](https://www.corbado.com/glossary/conditional-ui) autofill plus
an autoprompt that opens the passkey dialog on page load. Rollouts went in 1% to 5%
increments with a kill switch that reverts a release in under 15 minutes.

![Capital One sign-in before and after with passkey AutoPrompt and AutoFill placements](https://www.corbado.com/website-assets/authenticate_2026_capital_one_passkey_ux_placements_68cb2302bb.jpg)

_Source: Dhaval Shah (Capital One), Authenticate 2026_

## 7. Which Signals tell you a User is ready for Password Removal?

A user is ready for password removal when they use passkeys consistently, have a backup
method and do not hit passkey failures on the devices they use. Speakers at Authenticate
2026 named concrete signals. Meta checks for a recovery method or second secure method.
Mercari disables the password as soon as a passkey exists. [eBay's](https://www.corbado.com/blog/ebay-passkeys)
data shows why device coverage matters before switching anything off.

- **Passkey coverage must hold on every device the user owns:** Manisa Mondal (Senior
  Product Manager, [eBay](https://www.corbado.com/blog/ebay-passkeys)) reported that passkeys now cover 25% of
  all [eBay](https://www.corbado.com/blog/ebay-passkeys) sign-ins, up from 15% a year earlier. Coverage varies
  widely: 57% on [iOS](https://www.corbado.com/blog/webauthn-errors), 34% on
  [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) and 14% on desktop web. In
  [eBay's](https://www.corbado.com/blog/ebay-passkeys) survey of more than 8,000 users, 7 in 10 switch devices,
  and [cross-device](https://www.corbado.com/blog/webauthn-cross-device-authentication-passkeys-mobile-first)
  problems were the top reason users stopped using passkeys.
- **Stale passkeys must not cause repeated failures:** [eBay's](https://www.corbado.com/blog/ebay-passkeys)
  passkey sign-in success is 93%, with about 95% of failures caused by stale passkeys.
  Removing passwords for users who regularly hit stale passkeys would lock them out. eBay
  fixes this with the [WebAuthn Signal API](https://www.corbado.com/blog/webauthn-signal-api).
- **The passkey must come first in the flow:** The FIDO Passkey Index found that 2
  participants still show a password or OTP before the passkey. One estimates that
  passkey-first would roughly double its passkey sign-in share.
- **Edge cases need a path before the password goes:** Mercari's Tatsuya Karino named
  users with no valid email and no verified attributes. Without a password, they could
  only reach customer support. Test accounts are another edge case.

![eBay passkey sign-in outcomes with 93% success and about 95% of failures caused by invalid keys](https://www.corbado.com/website-assets/authenticate_2026_ebay_stale_passkeys_521980936a.jpg)

_Source: Manisa Mondal and Ilangovan Vairakkalai (eBay), Authenticate 2026_

Corbado's Passkey Benchmark 2026 shows the same device effect: on a recognized device,
passkey logins succeed 95% to 99% of the time. On an unrecognized desktop the rate drops
to 55% to 70%, and 35% to 50% of successful logins there need a phone via
[cross-device authentication](https://www.corbado.com/blog/proximity-exchange-protocol-pxp)
([Passkey Benchmark 2026](https://www.corbado.com/blog/world-passkey-day-passkey-benchmark-2026)).

## 8. How do Enterprises remove Passwords for their Employees?

Enterprises remove workforce passwords, meaning the passwords of their own employees,
through staged, group-based waves and policy enforcement. General Motors moved more than
200,000 workforce users in 19 waves. Microsoft enforces
[phishing](https://www.corbado.com/glossary/phishing)-resistant-only sign-in for all its employees and will
retire native SMS and voice delivery in Microsoft Entra on 1 February 2027.

This section covers workforce authentication. The cases above (Mercari, Meta, PayPal and
Capital One) remove passwords for consumers. The approach differs because employers
control devices, policies and onboarding, while consumer services do not.

### 8.1 General Motors

Andrew Cameron (Distinguished Engineer, Cybersecurity, GM) and Nick LewAllen (Sr. Identity
Engineer, Cybersecurity, GM) first moved MFA enforcement from ADFS to Entra Conditional
Access in 8 waves. They then switched users to cloud authentication and passkeys in 11
waves from February 2025 to February 2026.

Around 100,000 users are on managed devices, where
[Windows Hello](https://www.corbado.com/glossary/windows-hello) and Platform
[SSO](https://www.corbado.com/blog/passkeys-single-sign-on-sso) satisfy a
[passkey policy](https://www.corbado.com/faq/multiple-passkeys-per-account). Plant workers who cannot carry
phones needed other methods. SMS OTP was deprecated as an MFA method on the way. Their
main lesson: design for the exceptions first.

### 8.2 Microsoft

Marina Sanchez (Product Manager, Microsoft) said Microsoft reached 99.9%
phishing-resistant authentication in its workforce by removing phishable credentials. Hana
Kim (Senior Product Manager, Microsoft) reported that system-preferred authentication
raised passkey sign-ins across the Entra user base by 380%. According to Sangeeta Ranjit
(Principal Lead PM, Microsoft), Microsoft has started eliminating passwords at account
creation for consumers and plans the same for
[Entra](https://learn.microsoft.com/en-us/entra/identity/authentication/). Our
[Entra passkeys guide](https://www.corbado.com/blog/entra-passkeys) covers the setup.

## 9. How Corbado can help

Every case in this article removed passwords only after the data showed it was safe.
Mercari watched password reliance fall from 75% to 22%, Meta checks for a recovery method
per user and Capital One gated each release with KPIs and a kill switch. Most teams cannot
see these signals today, because their identity provider reports logins and not which
method a user really relies on. [Corbado Observe](https://www.corbado.com/observe), the
[authentication observability](https://www.corbado.com/blog/authentication-observability) layer, adds that view
on top of the existing login, with no passkey programme required to start.

[Login Methods](https://www.corbado.com/observe/login-methods) shows passkey, password and OTP side by side over
time, so password reliance becomes a share of your traffic you can track like Mercari did.
Technology splits every login and enrollment by OS, OS version and browser, and Device
Health classifies ceremony outcomes per device brand and model. That answers eBay's
question of whether passkeys hold on every device before the password goes.
[Passkey Errors](https://www.corbado.com/observe/passkey-errors) attributes failed ceremonies to a WebAuthn
reason, so stale passkeys and cross-device problems show up before they turn into
lockouts. [Authenticator Inventory](https://www.corbado.com/observe/authenticator-inventory) counts synced and
device-bound credentials apart, which matters when a user loses a device.

[Video: Rollout rules](https://www.corbado.com/videos/features/rollout-rules.mp4) ([See how Corbado Connect ships this](https://www.corbado.com/connect))

Once the data shows which users are ready, [Corbado Connect](https://www.corbado.com/connect) acts on it. Its
components are built around the
[identifier-first approach](https://www.corbado.com/faq/identifier-first-approach-passkey-login), the same
pattern Mercari used to decide per account which factors to offer.
[Passkey Intelligence](https://docs.corbado.com/corbado-connect/features/passkey-intelligence)
decides on [passkey availability](https://www.corbado.com/faq/are-passkeys-available) from the client environment
and the existing passkeys of that user.
[Rollout Rules](https://www.corbado.com/faq/gradual-rollout-support-passkey-adoption) gate passkey creation and
login per client, and every rule ends in allow, block or allow with sampling. A ruleset
can be replayed against recorded traffic before it takes effect. A project-level kill
switch drops [passkey login](https://www.corbado.com/blog/passkey-login-best-practices), append and management
into fallback in one move, with no app store update in the loop, which covers the safety
net Capital One built for its own rollout.

## 10. Conclusion

Authenticate 2026 delivered the first broad case data on removing passwords. Mercari cut
password reliance from 75% to 22% and password sign-ups to about 1%, starting at sign-up
and disabling the password per user based on signals. The FIDO Passkey Index counts 9 of
13 relying parties planning passwordless accounts within 12 months, with passkeys at 36%
of sign-ins and a 93% success rate. Meta adds friction to password logins before it
removes them, PayPal closes phishable fallbacks and Capital One gates every release with
small increments and a kill switch. GM shows that more than 200,000 workforce users can
move in repeatable waves when the exceptions are designed first.

## Frequently Asked Questions

### How did Mercari remove passwords for existing users?

Mercari disables passwords per account based on signals. Registering a passkey disables
the password, a high risk score such as a residential proxy or VPN disables it for that
login and detected account takeover revokes it. Automatic passkey upgrades after
password-manager logins also remove the password. Password reliance at login fell from 75%
to 22% in three years, Mercari reported at Authenticate 2026.

### What share of companies plan passwordless accounts?

According to the FIDO Passkey Index 2026, 9 of 13 responding relying parties plan to
deploy passwordless accounts within 12 months, one of them on an exploratory basis. One
more is researching the option and three have no plans yet. The Index is based on
confidential data from 15 large consumer relying parties and was presented at
Authenticate 2026.

### Should passkeys be mandatory before passwords are removed?

Meta's approach suggests yes: mandate passkey creation first and remove passwords later.
Meta began requiring passkey creation for advertiser accounts in August 2026, without
removing any passwords. It used a grace period of 14 to 30 days, repeated warnings and
briefed support teams. Meta's Jason Cheung called the mandate relatively low friction
overall, despite confusion about OS requirements. Password removal itself only follows
once users have a passkey, use it everywhere and have a recovery method or second secure
method.

### Why do passkeys not stop account takeover while passwords remain?

Passkeys protect only the sign-ins that use them. PayPal reported at Authenticate 2026
that it sees no phishing among passkey logins, yet attackers still take over accounts
through SMS OTP and password fallbacks. They then register their own passkeys. Removing
phishable fallbacks for passkey users is therefore required to turn passkey adoption into
account takeover protection.

### How long does an enterprise password removal take?

General Motors needed about a year to move its workforce to cloud authentication and
passkeys, running 11 waves from February 2025 to February 2026 after 8 earlier MFA
migration waves. In total, 19 waves covered more than 200,000 users. GM's lessons were to
design for exceptions first, get user data right before each cutover and communicate
heavily through enterprise channels.