Fast decisions, higher risks: Analyzing the speed–accuracy trade-off in compare-and-confirm authentication
Abstract
People routinely complete fast “compare-and-confirm” checks—approving a login notification, matching a short code to link a TV, or confirming a Bluetooth numeric comparison. The appeal is speed; the risk is habituated tapping and weak binding that can lead to false approvals. We ask whether decision time can serve as an operator-friendly, fairness-aware risk signal that complements protocol/UI hardening. Using de-identified condition summaries from N=73 participants (558 participant×condition blocks), we model correctness across Scenario×Device×CodeLen with a population-average grouped-binomial framework, then focus on attack blocks where the failure is false approval. Benign handling remains near the ceiling across devices and code lengths, and moving from 4 to 6 digits does not measurably harm benign correctness. In aggregate, the timing coefficient is modest and not universally decisive, but distributional evidence shows that very fast attack handling concentrates false approvals; exploratory moderation reveals a stronger “slower-is-safer” association for identifiable groups (e.g., older and lower self-rated security skill). Operationally, we implement a straightforward timing gate that activates only when a user’s behavior is notably faster than their established baseline. Through cross-validation, a 10th-percentile timing gate achieves TPR ≈ 0.52, FPR ≈ 0.47, PPV ≈ 0.55, and NPV ≈ 0.50, providing bounded-cost operating points with calibration diagnostics. We recommend progressive, adaptive frictio—e.g., number matching, brief holds, or re-compare—triggered only at fast, high-risk moments. Treating time as a deployable behavioral signal hardens the riskiest moments in push authentication and pairing-style confirmations without taxing everyday use.