What I Say Means What I Do: Risk Concerns and Mobile Application-Selection Behaviors.

Area of Science:

• Human-computer interaction
• Cybersecurity
• Behavioral science

Background:

• Users are often considered the weakest link in cybersecurity and privacy.
• Leveraging user preferences can potentially enhance security measures.
• Previous research shows inconsistent findings on the link between privacy concerns and user behavior.

Purpose of the Study:

• To investigate the relationship between users' reported risk concerns and their decision-making in mobile application selection.
• To determine how the timing of risk concern assessment affects its predictive power on app choice behavior.

Main Methods:

• Three experiments were conducted to assess self-reported risk concerns at different time points: pre-screen (weeks before), pre-task (immediately before), and post-task (immediately after).
• The study also manipulated the availability and placement of clear definitions and quizzes for risk categories to ensure user comprehension.

Main Results:

• Risk concerns reported immediately after the app-selection task (post-task) significantly predicted user behavior.
• Risk concerns reported weeks before the task (pre-screen) showed inconsistency, suggesting concerns may not be stable over time or contexts.
• Pre-task risk concerns strongly predicted behavior only when preceded by clear definitions and quizzes, highlighting the importance of understanding risk categories.

Conclusions:

• Self-reported risk concerns can be unstable across different times and contexts.
• When accompanied by clear definitions, risk concerns assessed immediately before or after an app selection task significantly predict user behavior.