Prospect Theory
Prospect theory is a model of decision-making in which people evaluate outcomes relative to a reference point and respond differently to possible gains and possible losses.
Why it matters online
After a breach, account takeover, fraud loss, or ransomware incident, the current situation can feel like a certain loss. An unverified recovery offer may then look appealing because it keeps alive a chance of getting back to zero.
How it can be exploited
A follow-on scammer can frame payment as the last remaining path to undo an existing loss. The offer does not need to feel completely trustworthy if the alternative feels like accepting that the loss is permanent.
Recognition signals
- A risky recovery offer feels reasonable mainly because every other option appears to confirm the loss.
- The promise focuses attention on getting back to zero while the source of the offer remains unverified.
- A decision is being made during a crisis without the people or process chosen before the incident.
Protective questions
- Would this offer still look reasonable if we were not already facing a loss?
- Who can verify this claim through a channel the sender did not provide?
- What decision rule did we establish before the crisis began?
A gamble can look different after a loss
Prospect theory describes how people make decisions under risk relative to a reference point. A possible outcome is not evaluated only as a final total; it can feel like a gain or loss compared with where the person believes they currently stand.
One important pattern is that people may prefer certainty when choosing between gains but become more willing to take a risk when choosing between losses.
That does not mean people always gamble after a loss. It means the framing of a decision can change which option feels attractive.
What the 1979 problem showed
In one hypothetical choice problem reported by Daniel Kahneman and Amos Tversky, 95 participants chose between:
- A certain loss of 3,000.
- An 80% chance of losing 4,000 and a 20% chance of losing nothing.
Ninety-two percent chose the gamble.
The problem did not involve ransomware, real incident response, or an actual organizational loss. It supports the general risk-seeking pattern in the domain of losses; it cannot predict what a particular person or team will do.
Why recovery scams can exploit the frame
An organization in the middle of a ransomware incident may already be facing stolen data, downtime, legal obligations, customer impact, and financial loss.
An unsolicited recovery service can offer a gamble: pay again for some chance that the data will be returned and every copy deleted. The promise may remain attractive even when the supposed rescuer has not proved who they are.
The offer is not persuasive because it is safe. It is persuasive because it appears to preserve the last path back to zero.
Build the decision before the pressure
Do not expect a team to invent its best verification process at the worst point of an incident. Decide in advance who can communicate with attackers, who can evaluate recovery claims, and which legal, insurance, response, and law-enforcement contacts will be involved.
When an unexpected offer arrives, ask:
Would this still look like a good option if we were not already trying to escape a loss?
Sources
- Prospect Theory: An Analysis of Decision under Risk (opens in a new tab)
Econometrica · Supports: Primary paper introducing prospect theory and reporting risk aversion in choices involving sure gains alongside risk seeking in choices involving sure losses. Its hypothetical problems did not study cyber incidents.
Related cases
Video breakdownThe “Rescue” Was Another Ransom... Inside Ransom Busters
GuidePoint says a supposed ransomware-recovery service contacted victims before some incidents were public. Accurate details can prove access without proving that the person offering help is trustworthy.
Related concepts
Urgency
How real or manufactured time pressure narrows attention and makes the fastest available action feel necessary.
Demo conceptExplore the concept