Passkeys at Scale: eBay, Schenker, congstar (EIC 2026)

1. Introduction: Passkeys at Scale at EIC 2026#

At the European Identity and Cloud Conference 2026 in Berlin, passwordless stopped being a roadmap slide. The most interesting CIAM sessions were not about whether passkeys work, but about what happens after you ship them to tens of millions of users. Three case studies stood out because they came with real numbers: eBay, DB Schenker and congstar.

Hard KPIs from production deployments are exactly the kind of evidence that turns a passkey adoption business case from a security pitch into a budget decision. Here is what each company reported at EIC 2026, and what it means for anyone planning a large-scale passkey rollout.

2. eBay: 100 Million Users have seen the Prompt#

Anand Bahety and Neeta Raina from eBay's identity team walked through a three-year journey of rolling out FIDO-based passkeys across web, mobile web and the app.

The headline numbers from their talk:

• 100 million plus users have seen the passkey prompt and had the chance to opt in
• Around 50% opt-in rate on mobile web and in the app, notably lower on desktop web
• 20% active usage, meaning one in five sign-ins now happens via passkey
• Of the users who enrolled, 74% were buyers and 26% sellers

2.1 Four Ps of Passkey#

The most useful takeaway was less about the numbers and more about the framing. eBay described what they call the "four Ps of passkey": prime, prompt, pattern and personalized. In other words, adoption is not a single toggle. You prime users before you ask, you time the prompt well, you respect the device and behavior pattern, and you personalize the ask. Their adoption curve over three years was explicitly non-linear, a healthy reminder that passkey rollouts compound rather than spike.

The other quiet point: passkey sign-in success rates were meaningfully higher than passwords. That is the part that turns a security project into a conversion project.

3. DB Schenker: 70% Passkey Adoption across the Workforce#

James Naughton (DB Schenker, running the Schenker Identity Management Service) and Andre Priebe (iC Consult) presented one of the most KPI-rich sessions of the whole conference, covering workforce, partners, customers and non-human identities in one ecosystem.

What they reported:

• 80,000 plus direct employees, plus 30,000 to 40,000 knowledge workers in an extended workforce
• 150,000 users across 400 integrated web apps
• 70% passkey adoption across the white-collar population
• 500,000 plus customer accounts in scope
• Customer rollout time cut from 6 weeks to 2 weeks
• 25% fewer customer-service calls after the rollout

That last metric is the one to underline. A 25% drop in support calls is the kind of number that pays for an identity program on its own, and it maps directly to the login-friction story we keep seeing in large, infrequently-used customer bases.

4. congstar: 7 Million Identities, migrated without breaking UX#

Sebastian Hampel (congstar) showed how to modernize CIAM across a multi-brand environment, treating security and UX as shared design guardrails rather than competing priorities.

Their numbers:

• 7 million plus customer identities, with a target of 8 million this year
• 4 brands running on the same platform (congstar, Frank, Yamobile, Pennymobile)
• 95% of user sessions migrated without noticeable disruption
• Measurable fraud reduction after making MFA mandatory
• Steady passkey adoption with high user acceptance

The interesting structural lesson here is multi-brand. One identity platform serving four consumer brands means you cannot tune the UX for a single audience. The 95% frictionless-migration figure is the proof point that a careful migration of existing password users beats a hard cutover every time.

5. Technical Undercurrent: Passkeys grow into Wallets#

John Bradley from Yubico tied the consumer story to where it is heading next: from authentication to credential protection, and on to digital identity wallets. One concrete data point from his session on the infrastructure side: a locally attached HSM handled around 1,800 signatures per second, dropping to roughly 500 per second over a remote 5G HSM. For issuers thinking about scale and cost, that gap matters, and it points to potential order-of-magnitude cost reductions when the architecture is right.

6. What this means for your Rollout#

A few patterns repeat across all three case studies:

1. Adoption is a curve, not a switch. eBay's three-year non-linear growth and congstar's staged migration both say the same thing: plan for compounding, not a launch-day spike.
2. Measure the business metric, not just the security one. Schenker's 25% drop in support calls and eBay's higher success rates are what move budget.
3. UX is the lever. Prime and time the prompt (eBay), migrate without disruption (congstar), and adoption follows.
4. Mobile leads, desktop lags. eBay's ~50% mobile opt-in versus lower desktop is a consistent split worth designing around.

If you are planning a passkey program, the question to bring back from EIC 2026 is not "do passkeys work" but "what is our opt-in curve, and which business metric proves it". The same toolkit that surfaced these KPIs, passkey analytics and observability, is what lets you answer that for your own user base.

7. Conclusion#

EIC 2026 made one thing clear: passkeys at scale are no longer a question of feasibility but of execution. eBay, DB Schenker and congstar each shipped to millions of users and came back with the same lesson, that adoption is engineered through priming, timing and frictionless migration rather than flipped on with a switch.

For teams building consumer and workforce identity, the practical move is to instrument the funnel, treat the opt-in rate as a product KPI and tie passkey adoption to the operational metrics, support load, conversion and fraud, that decision-makers already track.

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →

Frequently Asked Questions#

What passkey adoption numbers did eBay report at EIC 2026?#

eBay reported that more than 100 million users have seen the passkey prompt, with around a 50% opt-in rate on mobile web and in the app, and 20% active usage meaning one in five sign-ins now happens via passkey. Of enrolled users, 74% were buyers and 26% sellers, and adoption grew non-linearly over three years.

How much did DB Schenker reduce support costs after rolling out passkeys?#

DB Schenker reported 70% passkey adoption across its white-collar workforce and a 25% reduction in customer-service calls after the rollout. The program covered 80,000 plus employees, 150,000 users across 400 web apps and 500,000 plus customer accounts, while cutting customer rollout time from six weeks to two weeks.

How did congstar migrate millions of identities to passkeys without breaking UX?#

congstar migrated 95% of user sessions without noticeable disruption across a multi-brand platform serving 7 million plus customer identities, with a target of 8 million. It ran four consumer brands on one platform, made MFA mandatory to reduce fraud and reported steady passkey adoption with high user acceptance.

What is the business case for passkeys based on EIC 2026 case studies?#

The strongest business signals were operational: DB Schenker's 25% drop in support calls and eBay's higher sign-in success rates show passkeys move conversion and cost metrics, not just security ones. Mobile consistently leads desktop on opt-in, and adoption behaves as a compounding curve rather than a launch-day spike.

How are passkeys connected to digital identity wallets?#

Yubico framed passkeys as the on-ramp to credential protection and digital identity wallets. One infrastructure data point: a locally attached HSM handled around 1,800 signatures per second, dropping to roughly 500 per second over a remote 5G HSM, pointing to potential order-of-magnitude cost reductions for issuers when the architecture is right.