I ve Got Nothing to Lose : Consumers Risk Perceptions and Protective Actions after the Equifax Data Breach

Transcription

1 I ve Got Nothing to Lose : Consumers Risk Perceptions and Protective Actions after the Equifax Data Breach Yixin Zou, Abraham H Mhaidli, Austin McCall, Florian Schaub

2 Who has heard of the Equifax data breach? 2

3 Who has heard of the Equifax data breach? Who was affected by this breach? 3

4 Who has heard of the Equifax data breach? Who was affected by this breach? For those affected, how many of you have frozen your credit report? 4

5 One of the big three U.S. credit bureaus. 5

6 One of the big three U.S. credit bureaus. Key function Provide credit reports of individual consumers to businesses. 6

7 THE EQUIFAX DATA BREACH Made public on September 7 th, million consumers affected. [1] Information exposed: Names Addresses Birth dates SSNs [1] 7

8 THE EQUIFAX DATA BREACH Available protective measures: Credit freeze. Fraud alert. Identity theft protection. Credit monitoring.... 8

9 THE EQUIFAX DATA BREACH Available protective measures: Credit freeze. Fraud alert. Identity theft protection. Credit monitoring.... Low usage of credit freeze and fraud alert. [2] [2] 9

10 RESEARCH QUESTIONS 1. What are consumers mental models of credit bureaus? 10

11 RESEARCH QUESTIONS 1. What are consumers mental models of credit bureaus? 2. How do consumers perceive the risks of the Equifax data breach? 11

12 RESEARCH QUESTIONS 1. What are consumers mental models of credit bureaus? 2. How do consumers perceive the risks of the Equifax data breach? 3. What protective actions did consumers take in response to the Equifax data breach, and what are their reasons for taking or not taking actions? 12

13 RESEARCH METHOD 24 semi-structured interviews between Jan. and Feb Recruitment Social media and lists. Screening survey for diverse demographics. 13

14 PARTICIPANT DEMOGRAPHICS Gender 3 Age Male Female

15 1 3 2 PARTICIPANT DEMOGRAPHICS Income Education <25k 25-50k 50-75k k k k >150k 4 15 No college Graduate 10 Bachelor

16 Exit survey PARTICIPANT DEMOGRAPHICS NFEC financial decision test. CFPB financial well-being scale. 16

17 Exit survey PARTICIPANT DEMOGRAPHICS NFEC financial decision test. CFPB financial well-being scale. Results Medium level of self-assurance regarding financial situations. Good knowledge of entry-level financial decisions. 17

18 KEY FINDINGS Mental Model Risk Perception Protective Action 18

19 Mental Model Most aware of big bureaus and their function. KEY FINDINGS Risk Perception Protective Action 19

20 Mental Model Incomplete and inaccurate understanding of: Types of info collected. Information providers. Customers. KEY FINDINGS Risk Perception Protective Action 20

21 Fig 1. An example of incomplete mental models 21 P18

22 22 Length of credit history? Public records? Inquiries?... P18 Fig 1. An example of incomplete mental models

23 Public record repositories? Debt collectors?... Fig 1. An example of incomplete mental models 23 P18

24 Fig 2. An example of inaccurate mental models 24 P9

25 Fig 2. An example of inaccurate mental models 25 P9

26 Mental Model Most aware of big bureaus and their function. Incomplete and inaccurate understanding. KEY FINDINGS Risk Perception Most aware of the breach. Protective Action 26

27 Mental Model Most aware of big bureaus and their function. Incomplete and inaccurate understanding. KEY FINDINGS Risk Perception Most aware of the breach. Identity theft and privacy invasion. Protective Action 27

28 Mental Model Most aware of big bureaus and their function. Incomplete and inaccurate understanding. KEY FINDINGS Risk Perception Most aware of the breach. Identity theft and privacy invasion. Optimism bias. Protective Action 28

29 REASONS FOR OPTIMISM BIAS The I ve got nothing to lose fallacy. 29

30 I don t have any credit. I have a bad record so I wouldn t do that [check Equifax s website to see if affected]. Nobody can hurt me. It s already at the lowest place. (P5) 30

31 REASONS FOR OPTIMISM BIAS The I ve got nothing to lose fallacy. Vagueness in notification message. 31

32 REASONS FOR OPTIMISM BIAS The I ve got nothing to lose fallacy. Vagueness in notification message. 32

33 REASONS FOR OPTIMISM BIAS The I ve got nothing to lose fallacy. Vagueness in notification message. 33

34 REASONS FOR OPTIMISM BIAS The I ve got nothing to lose fallacy. Vagueness in notification message. Absence of negative signals. 34

35 REASONS FOR OPTIMISM BIAS The I ve got nothing to lose fallacy. Vagueness in notification message. Absence of negative signals. Presumption of not being included in Equifax s database. 35

36 Mental Model Most aware of big bureaus and their function. Incomplete and inaccurate understanding. KEY FINDINGS Risk Perception Most aware of the breach. Identity theft and privacy invasion. Optimism bias. Protective Action Most did not take actions. Various reasons for inaction. 36

37 Check Equifax's website Check credit report Closer self-monitoring Use credit monitoring service Freeze credit report Place fraud alert Use identity theft protection Took actions Aware, no action Unaware, no action Not mentioned 37

38 Check Equifax's website Check credit report Closer self-monitoring Use credit monitoring service Freeze credit report Place fraud alert Use identity theft protection Proactive Took actions Aware, no action Unaware, no action Not mentioned 38

39 Reactive Check Equifax's website Check credit report Closer self-monitoring Use credit monitoring service Freeze credit report Place fraud alert Use identity theft protection Proactive Took actions Aware, no action Unaware, no action Not mentioned 39

40 REASONS FOR INACTION Optimism bias 40

41 REASONS FOR INACTION Optimism bias Why would they come after me? If they re going to go to all the bother of stealing my identity, why don t they go after somebody with some real wealth? (P9) 41

42 Insufficient knowledge REASONS FOR INACTION Optimism bias 42

43 Insufficient knowledge REASONS FOR INACTION Optimism bias 43

44 Insufficient knowledge REASONS FOR INACTION Optimism bias 44

45 Insufficient knowledge REASONS FOR INACTION Optimism bias Tendency to delay 45

46 Optimism bias Insufficient knowledge REASONS FOR INACTION Tendency to delay I wait until something bad happens and then I will react to it, so maybe it's not as good as a proactive approach. So far I think I'm okay with all the finance and nobody's stole my identity yet. (P23) 46

47 FACTORS IMPACTING ACTION/INACTION Insufficient knowledge Optimism bias Tendency to delay Cost 47

48 FACTORS IMPACTING ACTION/INACTION Insufficient knowledge Optimism bias Tendency to delay Cost 48

49 FACTORS IMPACTING ACTION/INACTION Insufficient knowledge Optimism bias Tendency to delay Cost Source of advice 49

50 FACTORS IMPACTING ACTION/INACTION Insufficient knowledge Optimism bias Tendency to delay Cost Source of advice 50

51 FACTORS IMPACTING ACTION/INACTION Insufficient knowledge Optimism bias Tendency to delay False sense of security Source of advice Cost 51

52 Optimism bias False sense of security FACTORS IMPACTING ACTION/INACTION Insufficient knowledge Source of advice Tendency to delay Cost The freeze might have given me a false sense of security I haven t spread out the frequency of my reports. I haven't paid for reports more frequently than what I can get for free. (P16) 52

53 IMPLICATIONS Public Policy Technical Solution Educational Efforts 53

54 Public Policy Free and more frequent access to credit reports. IMPLICATIONS Technical Solution Educational Efforts 54

55 55

56 56

57 Public Policy Free and more frequent access to credit reports. Free credit freezes. IMPLICATIONS Technical Solution Educational Efforts 57

58 58

59 Public Policy Free and more frequent access to credit reports. Free credit freezes. Stringent and preemptive regulation. IMPLICATIONS Technical Solution Educational Efforts 59

60 Public Policy Free and more frequent access to credit reports. Free credit freezes. Stringent and preemptive oversight. IMPLICATIONS Technical Solution Enhancing usability of protective mechanisms. Educational Efforts 60

61 Public Policy Free and more frequent access to credit reports. Free credit freezes. Stringent and preemptive oversight. IMPLICATIONS Technical Solution Enhancing usability of protective mechanisms. Enhance transparency of information flows. Educational Efforts 61

62 Just-in-time notifications. 62

63 Just-in-time notifications. Integrate rights to approve and dispute. 63

64 Public Policy Free and more frequent access to credit reports. Free credit freezes. Stringent and preemptive oversight. IMPLICATIONS Technical Solution Enhancing usability of protective mechanisms. Enhance transparency of information flows. Educational Efforts Aiming educational resources at influencers. 64

65 Public Policy Free and more frequent access to credit reports. Free credit freezes. Stringent and preemptive oversight. IMPLICATIONS Technical Solution Enhancing usability of protective mechanisms. Enhance transparency of information flows. Educational Efforts Aiming educational resources at influencers. Better support interpersonal sources. 65

66 SUMMARY General awareness of credit bureaus, incomplete and inaccurate mental models. 66

67 SUMMARY General awareness of credit bureaus, incomplete and inaccurate mental models. High risk perception of the Equifax data breach, albeit optimism bias. 67

68 SUMMARY General awareness of credit bureaus, incomplete and inaccurate mental models. High risk perception of the Equifax data breach, albeit optimism bias. Various reasons for inaction: optimism bias, insufficient knowledge, tendency to delay etc. 68

69 SUMMARY General awareness of credit bureaus, incomplete and inaccurate mental models. High risk perception of the Equifax data breach, albeit optimism bias. Various reasons for inaction: optimism bias, insufficient knowledge, tendency to delay etc. Implications for public policy, technical, and educational efforts. 69

70 SUMMARY General awareness of credit bureaus, incomplete and inaccurate mental models. High risk perception of the Equifax data breach, albeit optimism bias. Various reasons for inaction: optimism bias, insufficient knowledge, tendency to delay etc. Implications for public policy, technical, and educational efforts. Yixin Zou, 70