Device and risk-avoidance behavior in the context of cybersecurity phishing attacks

Phishing has been the most common type of cybercrime in recent years. The fact that successful phishing attempts require victims to collaborate with their attackers highlights the importance of identifying factors that influence users’ avoidance behavior. Drawing from evidence that mobile users process information differently than personal computer (PC) users, this research suggests that the device used may influence users’ risk-avoidance behavior, as manifested in their tendency to avoid clicking on potentially risky messages. Indeed, three studies suggest that mobile users are more risk-avoidant than PC users. Specifically, analyzing data from a cybersecurity company regarding ∼500,000 URL requests in a sample of household networks, we show that mobile devices are less likely than PCs to access unsafe URLs. Next, in two online controlled experiments in which device and URL risk levels were randomly assigned, we show that mobile users are less likely than PC users to click on a URL in a phishing-like message. Notably, this difference is observed for lower-risk URLs, whereas PC and mobile users display similar risk-avoidance tendencies in the presence of highly risky URLs. This work contributes to the mobile use literature, as well as to developing information systems theory regarding technology-threat avoidance, by showing that the device used is a contextual factor influencing users’ susceptibility to phishing attacks. • Counterintuitive results show that PC users engage in riskier clicking behavior than mobile users. • Analysis of 500k URL requests shows most unsafe clicks originate from PC devices. • Difference in risk avoidance between mobile and PC users is prominent for low-risk. • Device type can be used as a contextual factor in Technology Threat Avoidance Theory. • The device of use influences users' vulnerability to phishing attacks.