Stuck on a phishing lure: differential use of base rates in self and social judgments of susceptibility to cyber risk

Abstract

ABSTRACT How do people assess the likelihood of personal risk in online activity? In three pilot experiments and one preregistered experiment, we tested the motivational and cognitive mechanisms that shape self and social judgments of cyber security. In Pilot Studies 1–3, we probed for evidence of differential use of base rate information in forecasting the likelihood oneself or another person would engage in a risky behavior. In the preregistered experiment, we gathered direct evidence of differential use of base rate information through covert eye-tracking. Data suggest people self-enhance when assessing risk, believing they are less likely than others to engage in actions that pose a threat to their cyber security, particularly because they rely less on base rate information when predicting their own behavior compared to others’ behavior. Self and social judgments were not different when scenarios posed no risk. We discuss implications for self-insight and interventions to curb risky behavior in online activity.