Passkeys at Scale: eBay, Schenker, congstar (EIC 2026)

1. Introduction: Passkeys at Scale at EIC 2026#

At the European Identity and Cloud Conference 2026 in Berlin, passwordless stopped being a roadmap slide. The most interesting CIAM sessions were not about whether passkeys work, but about what happens after you ship them to tens of millions of users. Three case studies stood out because they came with real numbers: eBay, DB Schenker and congstar.

Hard KPIs from production deployments are exactly the kind of evidence that turns a passkey adoption business case from a security pitch into a budget decision. Here is what each company reported at EIC 2026 and what it means for anyone planning a large-scale passkey rollout.

The comparison below puts the three case studies next to each other so the scale, adoption and business impact are easier to scan.

2. eBay: 100 Million Users have seen the Prompt#

Anand Bahety and Neeta Raina from eBay's identity team walked through a three-year journey of rolling out FIDO-based passkeys across web, mobile web and the app.

The headline numbers from their talk:

• 100 million plus users have seen the passkey prompt and had the chance to opt in
• Around 50% opt-in rate on mobile web and in the app, notably lower on desktop web
• 20% active usage, meaning one in five sign-ins now happens via passkey
• Of the users who enrolled, 74% were buyers and 26% sellers

2.1 Four Ps of Passkey#

The most useful takeaway was less about the numbers and more about the framing. eBay described what they call the "four Ps of passkey": prime, prompt, pattern and personalized. In other words, adoption is not a single toggle. You prime users before you ask, you time the prompt well, you respect the device and behavior pattern and you personalize the ask. Their adoption curve over three years was explicitly non-linear, a healthy reminder that passkey rollouts compound rather than spike.

The other quiet point: passkey sign-in success rates were meaningfully higher than passwords. That is the part that turns a security project into a conversion project.

3. DB Schenker: SIMS Passwordless Journey across Employees, Partners and Customers#

James Naughton (DB Schenker, running the Schenker Identity Management Service) and Andre Priebe (iC Consult) presented one of the most KPI-rich sessions of the whole conference, covering workforce, partners, customers and non-human identities in one ecosystem.

The safest public baseline is this: DB Schenker's own SIMS passwordless journey describes a centralized digital identity hub for employees, partners and customers worldwide, with biometric authentication expanding across modern mobile devices, Windows and Apple computers. Older public Ping Identity material described more than 300,000 employees, contractors, partners and customers in scope, 50 migrated business applications and a 75% reduction in integration effort.

That makes the EIC takeaway more operational than numeric: the business case is not just that passkeys are stronger, but that one identity hub can reduce friction across workforce, partner and customer access at the same time.

4. congstar: 7 Million Identities, migrated without breaking UX#

Sebastian Hampel (congstar) showed how to modernize CIAM across a multi-brand environment, treating security and UX as shared design guardrails rather than competing priorities.

Their numbers:

• 7 million plus customer identities, with a target of 8 million this year
• 4 brands running on the same platform (congstar, Frank, Yamobile, Pennymobile)
• 95% of user sessions migrated without noticeable disruption
• Measurable fraud reduction after making MFA mandatory
• Steady passkey adoption with high user acceptance

The interesting structural lesson here is multi-brand. One identity platform serving four consumer brands means you cannot tune the UX for a single audience. The 95% frictionless-migration figure is the proof point that a careful migration of existing password users beats a hard cutover every time.

5. Technical Undercurrent: Passkeys grow into Wallets#

John Bradley from Yubico tied the consumer story to where it is heading next: from authentication to credential protection and on to digital identity wallets. One concrete data point from his session on the infrastructure side: a locally attached HSM handled around 1,800 signatures per second, dropping to roughly 500 per second over a remote 5G HSM. For issuers thinking about scale and cost, that gap matters, and it points to potential order-of-magnitude cost reductions when the architecture is right.

6. What this means for your Rollout#

A few patterns repeat across all three case studies:

1. Adoption is a curve, not a switch. eBay's three-year non-linear growth and congstar's staged migration both say the same thing: plan for compounding, not a launch-day spike.
2. Measure the business metric, not just the security one. Schenker's SIMS journey and eBay's higher success rates are what move budget.
3. UX is the lever. Prime and time the prompt (eBay), migrate without disruption (congstar) and adoption follows.
4. Mobile leads, desktop lags. eBay's ~50% mobile opt-in versus lower desktop is a consistent split worth designing around.

If you are planning a passkey program, the question to bring back from EIC 2026 is not "do passkeys work" but "what is our opt-in curve and which business metric proves it". The same toolkit that surfaced these KPIs, passkey analytics and observability, is what lets you answer that for your own user base.

7. Conclusion#

EIC 2026 made one thing clear: passkeys at scale are no longer a question of feasibility but of execution. eBay, DB Schenker and congstar each shipped to millions of users and came back with the same lesson, that adoption is engineered through priming, timing and frictionless migration rather than flipped on with a switch.

For teams building consumer and workforce identity, the practical move is to instrument the funnel, treat the opt-in rate as a product KPI and tie passkey adoption to the operational metrics, support load, conversion and fraud, that decision-makers already track.

About Corbado

Corbado is the Authentication Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →

Frequently Asked Questions#

What passkey adoption numbers did eBay report at EIC 2026?#

eBay reported that more than 100 million users have seen the passkey prompt, with around a 50% opt-in rate on mobile web and in the app and 20% active usage meaning one in five sign-ins now happens via passkey. Of enrolled users, 74% were buyers and 26% sellers, and adoption grew non-linearly over three years.

How much did DB Schenker reduce support costs after rolling out passkeys?#

DB Schenker's public SIMS material confirms a broad passwordless journey across employees, partners and customers, with FIDO2-enabled risk-based authentication and biometric authentication becoming the default once configured. Older public Ping Identity material describes more than 300,000 employees, contractors, partners and customers in the identity scope, 50 migrated business applications and a 75% reduction in integration effort. The exact EIC 2026 numbers around passkey adoption rate and support-call reduction should be treated as session-specific rather than public hard facts.

How did congstar migrate millions of identities to passkeys without breaking UX?#

congstar migrated 95% of user sessions without noticeable disruption across a multi-brand platform serving 7 million plus customer identities, with a target of 8 million. It ran four consumer brands on one platform, made MFA mandatory to reduce fraud and reported steady passkey adoption with high user acceptance.

What is the business case for passkeys based on EIC 2026 case studies?#

The strongest business signals were operational: eBay's higher sign-in success rates, congstar's low-friction migration and DB Schenker's SIMS journey all show passkeys move conversion, support and cost metrics, not just security ones. Mobile consistently leads desktop on opt-in, and adoption behaves as a compounding curve rather than a launch-day spike.

How are passkeys connected to digital identity wallets?#

Yubico framed passkeys as the on-ramp to credential protection and digital identity wallets. One infrastructure data point: a locally attached HSM handled around 1,800 signatures per second, dropping to roughly 500 per second over a remote 5G HSM, pointing to potential order-of-magnitude cost reductions for issuers when the architecture is right.