Nudging Users to Change Breached Passwords Using the Protection Motivation Theory

TL;DR

This work applies Protection Motivation Theory (PMT) to breach notifications to study how threat and coping appeals influence password-change intentions and actions. Using a real-world, ecologically valid design based on Have I Been Pwned breaches, the authors compare threat-only, coping-only, both, and control conditions in a large online experiment ($n=1{,}386$). Results show threat appeals increase intention while combining threat and coping appeals enhances actual password changes, albeit with small effects; perceptions of threat and coping, user security attitudes, and breach recency further shape outcomes. The findings illuminate PMT’s value for designing compromised credential notifications but also reveal practical and contextual barriers—such as account inactivity and password-ecosystem issues—that limit motivation and behavior, pointing to layered messaging, data-flow transparency, and personalized guidance as practical directions for real-world deployments.

Abstract

We draw on the Protection Motivation Theory (PMT) to design nudges that encourage users to change breached passwords. Our online experiment ($n$=$1,386$) compared the effectiveness of a threat appeal (highlighting negative consequences of breached passwords) and a coping appeal (providing instructions on how to change the breached password) in a 2x2 factorial design. Compared to the control condition, participants receiving the threat appeal were more likely to intend to change their passwords, and participants receiving both appeals were more likely to end up changing their passwords; both comparisons have a small effect size. Participants' password change behaviors are further associated with other factors such as their security attitudes (SA-6) and time passed since the breach, suggesting that PMT-based nudges are useful but insufficient to fully motivate users to change their passwords. Our study contributes to PMT's application in security research and provides concrete design implications for improving compromised credential notifications.

Figures (5)

• Figure 1: The threat appeal we used in our study.
• Figure 3: An overview of our experiment's procedure.
• Figure 4: Example breach information shown to participants.
• Figure 5: Company name and frequency of the breaches featured in our study (bubble size proportionate to each breach's frequency).
• Figure 6: How often each data type got leaked among the 127 breaches in our sample, excluding email addresses and passwords (appearing in all breaches). Eliminated 26 other types occurring twice or fewer.