Insights & Analyses

‘I’ve got nothing to lose:’ One year after Equifax breach, study finds consumer inaction due to ‘optimism bias’ – One World Identity

August 15, 2018

While the Equifax data breach increased consumer awareness of credit bureaus and identity data, a new survey of U.S. consumers found that most people did not take any action in the wake of the incident, as many people are apparently convinced identity theft won’t happen to them.

Note: Talk identity and credit and connect with professionals and insiders at the KNOW Conference 2019 in Las Vegas next March. Register now for Early Bird Pricing!

The lack of reaction to the Equifax incident is an example of “optimism bias in estimating one’s likelihood of victimization,” researchers at the University of Michigan School of information concluded in new research published this week.

For example, those polled expressed a belief that only “rich” people would be the targets of identity theft as a result of the stolen, sensitive data. Another common refrain from respondents was, “I’ve got nothing to lose.”

Through a series of 24 interviews, the researchers found that while consumers were more aware of the roles of credit bureaus in the wake of the Equifax breach, their understanding of how the financial systems work was incomplete. For example, few knew whether they were actually affected by the breach at all, despite tools readily available to show whether their information had been exposed.

Beyond optimism bias, the study also concluded that consumers were dissuaded from action by costs associated with protective measures — something that will be addressed by a nationwide law eliminating fees for credit freezes, set to take effect next month. Researchers also noted that consumers have what they called a “tendency toward delaying action until harm has occurred,” also playing into the optimism bias expressed by consumers.

“A majority of participants showed detailed awareness of identity theft risks (regardless of the sophistication of their mental models), and yet most did not translate this awareness into action,” the report reads. “For participants who had articulated mental models of credit bureaus but chose not to take action, their decisions seemed to be influenced by the misinterpretation of the outcome of existing tools and their own biases, rather than a lack of knowledge on how credit bureaus operate.”

In all, nearly 150 million people — or some 60 percent of U.S. adults — were affected by the Equifax breach that occurred just over one year ago. The leak included names, Social Security numbers, birth dates, addresses and more.

OWI Insight: The study reinforces the idea that perhaps the biggest threat to the identity industry is consumer apathy. Overcoming the optimism bias of consumers and encouraging them to place more value on their personally identifiable information is likely to remain a pain point within the data economy. In a post-Equifax world, innovators in identity will need to find a way to encourage end users to take steps to protect their own identity, in addition to implementing measures to avoid costly data breaches in the first place.