Mobile Devices Promote Risk-Avoidant Behavior, Reducing Phishing Success Rates

A study by Carnegie Mellon University and Ben-Gurion University found that mobile users are less likely to click on potentially risky links in phishing attacks compared to PC users. Researchers analyzed data from a cybersecurity company and conducted two online experiments, randomly assigning devices and URL risk levels to participants. The study suggests that device type influences users' risk-avoidance behavior, with mobile users exhibiting more cautious behavior.

A recent study by Carnegie Mellon University and Ben-Gurion University of the Negev Beer-Sheva has revealed that mobile users are less likely to click on potentially risky links in phishing attacks compared to PC users. The research, published in the International Journal of Information Management, offers insights into how the type of device influences users' risk-avoidance behavior [1].

The study, led by Naama Ilany-Tzur from Carnegie Mellon's Heinz College, analyzed data from a cybersecurity company that monitors URL requests from various devices. Researchers randomly selected 30 U.S. networks and examined approximately 500,000 URL requests over a week in August-September 2020. Two online experiments were conducted, involving more than 250 workers from the Amazon Mechanical Turk platform, to test users' responses to phishing-like messages [1].

The findings indicate that mobile users were less likely to click on URLs in phishing-like messages, especially when the risk was low. This behavior was observed across both PC and mobile users when faced with higher-risk URLs. The study suggests that the device type influences users' risk-avoidance behavior, with mobile users exhibiting more cautious behavior [1].

The research underscores the importance of identifying factors that influence users' avoidance behavior in cybersecurity. The findings can help cybersecurity firms design solutions that better fit the device being used and the desired user behavior. For example, the effectiveness of security mechanisms may be contingent on the device being used. The study also highlights the need for policies and regulations related to security and privacy [1].

The study's limitations include the inability to fully mimic actual phishing attacks in the experimental setting. However, the findings contribute to the growing understanding of risk-avoidance behavior in the context of cybersecurity.

References:
[1] https://techxplore.com/news/2025-08-cybercrime-users-phishing-differently-based.html