On Not Falling for Phish: Examining Multiple Stages of Protective Behavior of Information System End-Users

The adage, “old habits die hard” is especially relevant when humans learn new protective behaviors (i.e., dental flossing, IS security behaviors). The foundation that underlies many social-cognitive theories used in IS research is that intention to change predicts actual behavior change. Despite intentions to change, humans do not always change their habits due to actual or perceived obstacles, for example. In this study, user behavior, particularly with respect to vigilance over phishing attempts, will be investigated via the theoretical lens of a hybrid continuum-stage behavior change model adapted from health-related fields. The goal of this research will be to gain a better understanding of: a) whether there are distinct stages that distinguish end-users’ vigilance toward phishing attempts; b) if so, can this research study confirm three distinct stages; and, c) what characterizes these different stages. This paper describes how we will examine our research questions through a research program.