Human error and cognitive bias

Rational choice theory says people select whichever option maximises their own satisfaction — a shopper comparing cereal brands on price, taste and nutrition. Expected utility theory narrows this to decisions made under risk and uncertainty, where the outcome is not guaranteed: an investor weighing several assets considers both the potential return and the probability of getting it, and picks whichever combination maximises expected utility. Both theories assume people compute this correctly. Kahneman and Tversky’s prospect theory showed they mostly do not.

Loss aversion. Losses are felt more intensely than an equivalent gain. A message reading “Your PayPal account has been frozen, and you need to click here to unlock it” exploits exactly this — the threatened loss of account access pulls harder than any equivalent framing of a gain would.

Framing effect. The same offer, presented as avoiding a loss rather than securing a gain, produces a stronger reaction. “Don’t miss out, sale ends soon!” outperforms “Get it now on sale!” for an identical deal — only the frame changed.

Anchoring effect. A judgement is built on the first number seen and adjusted only slightly from there. A car marked $30,000 looks expensive on its own; the same car marked “was $60,000, now $30,000” gets bought, because the buyer anchors on the size of the discount rather than the final price. Fake antivirus pop-ups use the same trick — “$1,000 per year, we are giving it away for $500” — and so do lottery scams, where the size of the promised jackpot makes a small “processing fee” look negligible by comparison.

Availability heuristic. Information that comes to mind easily gets treated as the best guide to what is likely, regardless of the real statistics. Someone who watched a shark-attack documentary the night before hesitates to swim the next morning — the vivid recollection outweighs the actual, very low, risk. “Spray and pray” SMS scams around tax time exploit the same effect, arriving exactly when a recent tax return is fresh in the recipient’s memory so an ATO-themed message feels immediately plausible.

Present bias and hyperbolic discounting. People weight an immediate cost far more heavily than a larger, merely delayed one. Postponing a software update because installing it now is inconvenient, even though leaving it unpatched carries a bigger long-term risk, is present bias in action. Hyperbolic discounting is the model decision scientists use to quantify it: the discount applied to future costs grows so steep that avoiding the present interruption dominates the choice, whatever the deferred cost turns out to be.

The privacy paradox is the same effect applied to privacy specifically: people say they care about it, then click “Accept” on a cookie banner, skip the privacy policy, and leave default sharing settings alone, because the immediate cost of reading and deciding outweighs a data-exposure risk that is diffuse and delayed.

Zero-risk bias. People prefer eliminating one risk completely over reducing total risk by a larger amount, because certainty feels better than a bigger but merely probabilistic improvement. Asked to rank hazard-site cleanup plans, participants preferred a plan that cleaned one site perfectly while leaving others untouched over a plan that reduced risk more overall across every site. The same bias shows up in security engineering: insisting on an information-theoretically perfect protocol for every channel, including low-risk internal ones, when a “very good but not perfect” alternative would cover far more ground for far less cost.