{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T15:35:37Z","timestamp":1781019337342,"version":"3.54.1"},"reference-count":70,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T00:00:00Z","timestamp":1757030400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000266","name":"Engineering and Physical Sciences Research Council (EPSRC)","doi-asserted-by":"publisher","award":["EP\/P011772\/1"],"award-info":[{"award-number":["EP\/P011772\/1"]}],"id":[{"id":"10.13039\/501100000266","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JCP"],"abstract":"<jats:p>Ransomware is a fast-evolving form of cybercrime in which a ransom is demanded to restore access to a victim\u2019s encrypted files. The business model of the criminals relies on victims being willing to pay the ransom demand. In this paper we use insights from behavioural economics to see how the framing of a ransom demand may influence willingness to pay the ransom. We then report the results of an experiment in which subjects (n=93) were shown eight different ransom demand splash screens, based on well-known examples of ransomware. The subjects were asked to rate and rank the ransom demands on six criteria that included willingness to pay and willingness to trust the criminals. This allows a within-subject comparison of different ransom demand frames. We find that trust is the main determinant of willingness to pay. We also find that positive framing is likely to increase willingness to pay compared to negative framing.<\/jats:p>","DOI":"10.3390\/jcp5030069","type":"journal-article","created":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T12:18:18Z","timestamp":1757074698000},"page":"69","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Ransomware Splash Screens, Loss Aversion and Trust: Insights from Behavioral Economics"],"prefix":"10.3390","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0194-9368","authenticated-orcid":false,"given":"Edward","family":"Cartwright","sequence":"first","affiliation":[{"name":"School of Accounting, Finance and Economics, De Montfort University, Leicester LE1 9BH, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1965-842X","authenticated-orcid":false,"given":"Anna","family":"Cartwright","sequence":"additional","affiliation":[{"name":"Independent Researcher, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0721-7571","authenticated-orcid":false,"given":"Lian","family":"Xue","sequence":"additional","affiliation":[{"name":"Economics and Management School, Wuhan University, Wuhan 430072, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,9,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1080\/23742917.2016.1252191","article-title":"Influences on ransomware\u2019s evolution and predictions for the future challenges","volume":"1","author":"Kalaimannan","year":"2017","journal-title":"J. Cyber Secur. Technol."},{"key":"ref_2","first-page":"136","article-title":"Ransomware, threat and detection techniques: A review","volume":"19","author":"Kok","year":"2019","journal-title":"Int. J. Comput. Sci. Netw. Secur."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"102490","DOI":"10.1016\/j.cose.2021.102490","article-title":"Ransomware: Recent advances, analysis, challenges and future research directions","volume":"111","author":"Beaman","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3514229","article-title":"A survey on ransomware: Evolution, taxonomy, and defense solutions","volume":"54","author":"Oz","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"40698","DOI":"10.1109\/ACCESS.2023.3268535","article-title":"The age of ransomware: A survey on the evolution, taxonomy, and research directions","volume":"11","author":"Razaulla","year":"2023","journal-title":"IEEE Access"},{"key":"ref_6","unstructured":"(2025, September 02). A Flawed Ransomware Encryptor. Available online: https:\/\/securelist.com\/a-flawed-ransomware-encryptor\/69481\/."},{"key":"ref_7","unstructured":"(2025, September 02). The Rise of Low Quality Ransomware G-DATA Security Blog. Available online: https:\/\/www.gdatasoftware.com\/blog\/2016\/09\/29157-the-rise-of-low-quality-ransomware."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L., and Kirda, E. (2015, January 17\u201319). Cutting the gordian knot: A look under the hood of ransomware attacks. Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Graz, Austria.","DOI":"10.1007\/978-3-319-20550-2_1"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1186\/s40163-024-00212-y","article-title":"Conti Inc.: Understanding the internal discussions of a large ransomware-as-a-service operator with machine learning","volume":"13","author":"Ruellan","year":"2024","journal-title":"Crime Sci."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"190023","DOI":"10.1098\/rsos.190023","article-title":"An economic analysis of ransomware and its welfare consequences","volume":"7","author":"Cartwright","year":"2020","journal-title":"R. Soc. Open Sci."},{"key":"ref_11","first-page":"2014","article-title":"Cryptolocker ransomware","volume":"20","author":"Jarvis","year":"2013","journal-title":"Viitattu"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Liao, K., Zhao, Z., Doup\u00e9, A., and Ahn, G.J. (2016, January 1\u20133). Behind closed doors: Measurement and analysis of CryptoLocker ransoms in Bitcoin. Proceedings of the APWG Symposium on Electronic Crime Research (eCrime), Toronto, ON, Canada.","DOI":"10.1109\/ECRIME.2016.7487938"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Spagnuolo, M., Maggi, F., and Zanero, S. (2014, January 3\u20137). Bitiodine: Extracting intelligence from the bitcoin network. Proceedings of the International Conference on Financial Cryptography and Data Security, Christ Church, Barbados.","DOI":"10.1007\/978-3-662-45472-5_29"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"101568","DOI":"10.1016\/j.cose.2019.101568","article-title":"The rise of crypto-ransomware in a changing cybercrime landscape: Taxonomising countermeasures","volume":"87","author":"Connolly","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"tyaa023","DOI":"10.1093\/cybsec\/tyaa023","article-title":"An empirical study of ransomware attacks on organizations: An assessment of severity and salient factors affecting vulnerability","volume":"6","author":"Connolly","year":"2020","journal-title":"J. Cybersecur."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"103162","DOI":"10.1016\/j.cose.2023.103162","article-title":"Between a rock and a hard (ening) place: Cyber insurance in the ransomware era","volume":"128","author":"Mott","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"453","DOI":"10.1126\/science.7455683","article-title":"The framing of decisions and the psychology of choice","volume":"211","author":"Tversky","year":"1981","journal-title":"Science"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"173","DOI":"10.1257\/jep.27.1.173","article-title":"Thirty years of prospect theory in economics: A review and assessment","volume":"27","author":"Barberis","year":"2013","journal-title":"J. Econ. Perspect."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"8","DOI":"10.1016\/S1361-3723(16)30036-7","article-title":"Ransomware: To pay or not to pay?","volume":"2016","author":"Everett","year":"2016","journal-title":"Comput. Fraud Secur."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Halikias, H. (2024). The Three Cs of Ransomware. Digital Shakedown: The Complete Guide to Understanding and Combating Ransomware, Springer.","DOI":"10.1007\/978-3-031-65438-1"},{"key":"ref_21","unstructured":"(2025, September 02). Exploring the Psychological Mechanisms Used in Ransomware Splash Screens. Sentin. One Rep.. Available online: https:\/\/www.sentinelone.com\/blog\/exploring-psychological-mechanisms-used-ransomware-splash-screens\/."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1006\/obhd.1998.2781","article-title":"The influence of framing on risky decisions: A meta-analysis","volume":"75","year":"1998","journal-title":"Organ. Behav. Hum. Decis. Process."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Rodr\u00edguez-Priego, N., Van Bavel, R., Vila, J., and Briggs, P. (2020). Framing effects on article security behavior. Front. Psychol., 11.","DOI":"10.3389\/fpsyg.2020.527886"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Laszka, A., Farhang, S., and Grossklags, J. (2017). On the economics of ransomware. Proceedings of the International Conference on Decision and Game Theory for Security, Springer.","DOI":"10.1007\/978-3-319-68711-7_21"},{"key":"ref_25","first-page":"65","article-title":"Game theory of data-selling ransomware","volume":"10","author":"Li","year":"2021","journal-title":"J. Cyber Secur. Mobil."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"2800","DOI":"10.1109\/TSC.2022.3220736","article-title":"Multistage Game Theoretical Approach for Ransomware Attack and Defense","volume":"16","author":"Zhang","year":"2022","journal-title":"IEEE Trans. Serv. Comput."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Yin, T., Sarabi, A., and Liu, M. (2023). Deterrence, backup, or insurance: Game-theoretic modeling of ransomware. Games, 14.","DOI":"10.3390\/g14020020"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"103742","DOI":"10.1016\/j.cose.2024.103742","article-title":"Economics of incident response panels in cyber insurance","volume":"140","author":"Arce","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"tyz009","DOI":"10.1093\/cybsec\/tyz009","article-title":"To pay or not: Game theoretic models of ransomware","volume":"5","author":"Cartwright","year":"2019","journal-title":"J. Cybersecur."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"102760","DOI":"10.1016\/j.cose.2022.102760","article-title":"Reducing ransomware crime: Analysis of victims\u2019 payment decisions","volume":"119","author":"Connolly","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"tyae013","DOI":"10.1093\/cybsec\/tyae013","article-title":"\u2018There was a bit of PTSD every time I walked through the office door\u2019: Ransomware harms and the factors that influence the victim organization\u2019s experience","volume":"10","author":"Mott","year":"2024","journal-title":"J. Cybersecur."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"McIntyre, D.L., and Frank, R. (2021). No Gambles with Information Security: The Victim Psychology of a Ransomware Attack. Cybercrime in Context: The Human Factor in Victimization, Offending, and Policing, Springer.","DOI":"10.1007\/978-3-030-60527-8_4"},{"key":"ref_33","unstructured":"Cartwright, A., Cartwright, E., and Xue, L. (November, January 30). Investing in prevention or paying for recovery-attitudes to cyber risk. Proceedings of the International Conference on Decision and Game Theory for Security, Stockholm, Sweden."},{"key":"ref_34","first-page":"102934","article-title":"Investigating the impact of ransomware splash screens","volume":"61","author":"Yilmaz","year":"2021","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Arief, B., Periam, A., Cetin, O., and Hernandez-Castro, J.C. (2020, January 25\u201327). Using eyetracker to find ways to mitigate ransomware. Proceedings of the 6th International Conference on Information Systems Security and Privacy (ICISSP 2020), Valletta, Malta.","DOI":"10.5220\/0008956004480456"},{"key":"ref_36","first-page":"69","article-title":"Impact of digital nudging on information security behavior: An experimental study on framing and priming in cybersecurity","volume":"1","author":"Sharma","year":"2021","journal-title":"Organ. Cybersecur. J. Pract. Process People"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"1395","DOI":"10.1007\/s10796-019-09970-6","article-title":"An examination of gain-and loss-framed messaging on smart home security training programs","volume":"24","author":"Plachkinova","year":"2022","journal-title":"Inf. Syst. Front."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"102644","DOI":"10.1016\/j.cose.2022.102644","article-title":"Preventive portfolio against data-selling ransomware\u2014A game theory of encryption and deception","volume":"116","author":"Li","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"300","DOI":"10.1057\/s41288-023-00288-8","article-title":"How cyber insurance influences the ransomware payment decision: Theory and evidence","volume":"48","author":"Cartwright","year":"2023","journal-title":"Geneva Pap. Risk Insur.-Issues Pract."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"103670","DOI":"10.1016\/j.cose.2023.103670","article-title":"Deception in double extortion ransomware attacks: An analysis of profitability and credibility","volume":"138","author":"Meurs","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Caporusso, N., Chea, S., and Abukhaled, R. (2018, January 21\u201325). A game-theoretical model of ransomware. Proceedings of the International Conference on Applied Human Factors and Ergonomics, Orlando, FL, USA.","DOI":"10.1007\/978-3-319-94782-2_7"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"728","DOI":"10.1108\/JFC-02-2022-0055","article-title":"An investigation of individual willingness to pay ransomware","volume":"30","author":"Cartwright","year":"2023","journal-title":"J. Financ. Crime"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"103099","DOI":"10.1016\/j.cose.2023.103099","article-title":"Protecting your business against ransomware attacks? Explaining the motivations of entrepreneurs to take future protective measures against cybercrimes using an extended protection motivation theory model","volume":"127","author":"Bekkers","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"263","DOI":"10.2307\/1914185","article-title":"Prospect Theory: An Analysis of Decision under Risk","volume":"47","author":"Kahneman","year":"1979","journal-title":"Econometrica"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"193","DOI":"10.1257\/jep.5.1.193","article-title":"Anomalies: The endowment effect, loss aversion, and status quo bias","volume":"5","author":"Kahneman","year":"1991","journal-title":"J. Econ. Perspect."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1509\/jmkr.42.2.129.62286","article-title":"Three cheers\u2014Psychological, theoretical, empirical\u2014For loss aversion","volume":"42","author":"Camerer","year":"2005","journal-title":"J. Mark. Res."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"599","DOI":"10.1007\/s11238-021-09839-8","article-title":"Individual-level loss aversion in riskless and risky choices","volume":"92","author":"Johnson","year":"2022","journal-title":"Theory Decis."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1257\/jel.20221698","article-title":"Meta-analysis of empirical estimates of loss aversion","volume":"62","author":"Brown","year":"2024","journal-title":"J. Econ. Lit."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"479","DOI":"10.1162\/003355397555262","article-title":"A test of the theory of reference-dependent preferences","volume":"112","author":"Bateman","year":"1997","journal-title":"Q. J. Econ."},{"key":"ref_50","first-page":"1133","article-title":"A model of reference-dependent preferences","volume":"121","author":"Rabin","year":"2006","journal-title":"Q. J. Econ."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"1093","DOI":"10.1037\/0022-3514.72.5.1093","article-title":"Gain\u2013loss frames and cooperation in two-person social dilemmas: A transformational analysis","volume":"72","author":"McCusker","year":"1997","journal-title":"J. Personal. Soc. Psychol."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"378","DOI":"10.1111\/j.1467-9280.2009.02296.x","article-title":"Bounded ethicality: The perils of loss framing","volume":"20","author":"Kern","year":"2009","journal-title":"Psychol. Sci."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"1107","DOI":"10.1177\/0093650219861256","article-title":"Can emotions capture the elusive gain-loss framing effect? A meta-analysis","volume":"47","author":"Nabi","year":"2020","journal-title":"Commun. Res."},{"key":"ref_54","first-page":"39","article-title":"Signaling theory: A review and assessment","volume":"37","author":"Connelly","year":"2011","journal-title":"J. Manag."},{"key":"ref_55","unstructured":"Karimov, F.P., Brengman, M., and Van Hove, L. (2011). The effect of website design dimensions on initial trust: A synthesis of the empirical literature. J. Electron. Commer. Res., 12."},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"373","DOI":"10.2307\/23044048","article-title":"What signal are you sending? How website quality influences perceptions of product quality and purchase intentions","volume":"35","author":"Wells","year":"2011","journal-title":"Mis Q."},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Aakash, A., and Aggarwal, A.G. (2019). Role of EWOM, product satisfaction, and website quality on customer repurchase intention. Strategy and Superior Performance of Micro and Small Businesses in Volatile Economies, IGI Global.","DOI":"10.4018\/978-1-5225-7888-8.ch010"},{"key":"ref_58","first-page":"55","article-title":"An assessment of the relationship between customer satisfaction and service friendliness","volume":"14","year":"1994","journal-title":"J. Organ. Behav. Manag."},{"key":"ref_59","doi-asserted-by":"crossref","first-page":"1001","DOI":"10.1037\/0021-9010.87.5.1001","article-title":"Mechanisms linking employee affective delivery and customer behavioral intentions","volume":"87","author":"Tsai","year":"2002","journal-title":"J. Appl. Psychol."},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"El-Ebiary, Y.A.B., Pathmanathan, P.R., Tarshany, Y.M.A., Jusoh, J.A., Aseh, K., Al Moaiad, Y., Al-Kofahi, M., Pande, B., and Bamansoor, S. (2021, January 15\u201317). Determinants of Customer Purchase Intention Using Zalora Mobile Commerce Application. Proceedings of the 2021 2nd International Conference on Smart Computing and Electronic Enterprise (ICSCEE), Cameron Highlands, Malaysia.","DOI":"10.1109\/ICSCEE50312.2021.9497995"},{"key":"ref_61","doi-asserted-by":"crossref","first-page":"341","DOI":"10.1037\/0003-066X.39.4.341","article-title":"Choices, values, and frames","volume":"39","author":"Kahneman","year":"1984","journal-title":"Am. Psychol."},{"key":"ref_62","doi-asserted-by":"crossref","first-page":"1039","DOI":"10.2307\/2937956","article-title":"Loss aversion in riskless choice: A reference-dependent model","volume":"106","author":"Tversky","year":"1991","journal-title":"Q. J. Econ."},{"key":"ref_63","doi-asserted-by":"crossref","first-page":"573","DOI":"10.2307\/2118482","article-title":"Anomalies in intertemporal choice: Evidence and an interpretation","volume":"107","author":"Loewenstein","year":"1992","journal-title":"Q. J. Econ."},{"key":"ref_64","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1509\/jmkg.73.6.1","article-title":"Does in-store marketing work? Effects of the number and position of shelf facings on brand attention and evaluation at the point of purchase","volume":"73","author":"Chandon","year":"2009","journal-title":"J. Mark."},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"900","DOI":"10.1257\/aer.101.2.900","article-title":"Search dynamics in consumer choice under time pressure: An eye-tracking study","volume":"101","author":"Reutskaja","year":"2011","journal-title":"Am. Econ. Rev."},{"key":"ref_66","doi-asserted-by":"crossref","unstructured":"Cartwright, A., and Cartwright, E. (2019). Ransomware and reputation. Games, 10.","DOI":"10.3390\/g10020026"},{"key":"ref_67","doi-asserted-by":"crossref","unstructured":"Exadaktylos, F., Esp\u00edn, A.M., and Branas-Garza, P. (2013). Experimental subjects are not different. Sci. Rep., 3.","DOI":"10.1038\/srep01213"},{"key":"ref_68","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1017\/CBO9780511921452.004","article-title":"Students as experimental participants","volume":"1","author":"Druckman","year":"2011","journal-title":"Camb. Handb. Exp. Political Sci."},{"key":"ref_69","doi-asserted-by":"crossref","first-page":"27","DOI":"10.1007\/s11166-021-09356-7","article-title":"Quantifying loss aversion: Evidence from a UK population survey","volume":"63","author":"Blake","year":"2021","journal-title":"J. Risk Uncertain."},{"key":"ref_70","unstructured":"Zorabedian, J. (2025, September 02). Did the FBI Really Say \u201cPay Up\u201d for Ransomware? Here\u2019s What to Do\u2026 2015. Available online: https:\/\/news.sophos.com\/en-us\/2015\/10\/28\/did-the-fbi-really-say-pay-up-for-ransomware-heres-what-to-do\/."}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/5\/3\/69\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:40:14Z","timestamp":1760035214000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/5\/3\/69"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,5]]},"references-count":70,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2025,9]]}},"alternative-id":["jcp5030069"],"URL":"https:\/\/doi.org\/10.3390\/jcp5030069","relation":{},"ISSN":["2624-800X"],"issn-type":[{"value":"2624-800X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,5]]}}}