Impact of 'Don't Know? Kasih No!' Campaign on Cybersecurity Awareness: Unraveling the Links to User Satisfaction, Trust, and Commitment

2.1 Trust - commitment theory

The Trust-Commitment theory was developed by Morgan and Hunt in 1994 in the context of relationship marketing [5]. The focus of this theory is to emphasize the importance of trust and commitment as two key elements that drive the success of long-term relationships between the parties involved [6]. The definition of trust is the belief in the integrity and reliability of the other party, while commitment is defined as a willingness to maintain a valuable relationship and invest resources to maintain the relationship [5]. In the context of using mobile banking, trust and commitment are the main pillars in building long-term relationships between customers and service providers [7]. Trust can be defined as a customer's confidence in mobile banking services can provide a sense of security, reliability, and be able to protect personal information from cybersecurity threats [8]. Meanwhile, commitment is an outcome based on a strong level of trust so that customers want to maintain relationships with service providers and use the banking services for a long period of time [9].

Awareness of the potential for cyberattacks plays an important role in shaping user trust [10]. The high awareness of cyber threats makes users cautious when using the service, which can reduce the trust level if the service is considered insecure [8]. However, through effective education efforts using social media, users can better understand the protection measures that need to be taken, so that their trust in mobile banking services increases [11, 12]. In addition, the perception of transaction risk also affects user trust and commitment [13]. Users who feel that the risk of transactions on mobile banking has increased can cause reluctance to use the service [8]. However, trust built through awareness of cyberattacks and cybersecurity measures can reduce this perception of risk, thereby increasing users' commitment to using mobile banking on an ongoing basis [14]. If users have a strong trust in mobile banking, then users tend to commit to using the service for a long period of time [15].

Trust-Commitment Theory is the right theoretical framework to explain the relationship between trust and commitment in using mobile banking. As threats to cybersecurity increase, the role of organizations in developing cybersecurity and reducing transaction risk with mobile banking can increase user trust. Therefore, customer trust in service security is an important factor for users to commit to using mobile banking. The strategy of educating users with digital storytelling through social media can increase cybersecurity awareness so that it is expected to increase user trust and commitment.

2.2 Extending trust and commitment theory with uses-gratification theory

The Uses-Gratification Theory (UGT) was introduced in the early 1940s in response to the traditional view that the audience is the passive recipient of media messages [16]. This view originated from Media Effect Theory where the media has a direct influence on the attitude and behavior of the audience [17]. However, UGT was developed in the 1970s which emphasized that the audience is an active agent who consciously chooses media to meet their psychological or social needs [18]. This theory highlights that cognitive, affective, personal, and social needs can be met through media consumption, and ultimately satisfaction with the choice of media is formed.

Along with the development of technology and digital media, UGT has been adapted to explain interaction with the internet and social media [19]. In the context of the internet and social media, this theory remains relevant because internet and social media users are looking for content that suits their needs [20, 21]. In addition, UGT has been used to understand motivation for activities in sharing information through online streaming service [21], playing online games [22], problematic smartphone use [23], information security education [24, 25], fake news [26-28], and cyberbullying [29]. Therefore, trends of UGT application in the context of problematic use of social media and smartphone is emerging.

Problematic smartphone use can lead to illegal activities, such as misuse of personal data or unauthorized access to digital networks [23]. In addition, the use of smartphones can facilitate criminal activities through cyberbullying, online fraud or cybercrime [30]. Previous research has shown that social motivation and self-expression have an important role in encouraging social media users to interact with and spread fake news even as they seek fact-checking to ensure the authenticity of the news [27]. This can be suppressed by applying the principle of caution to social media users [28]. Therefore, information security education is important to reduce the risk of the impact of problematic smartphone use [31]. The success of information security education is influenced by the satisfaction of social media users with the quality of content that is presented attractively so that it has the potential to be disseminated on a wider scope [24].

The satisfaction of social media users with the cybersecurity education video campaign "Don't Know Kasih No" can be explained by using Uses Gratification Theory. The theory can explain the relationship between content quality, entertainment elements, and social influence on satisfaction with educational content. Therefore, the researcher concluded that UGT is a relevant framework to understand how the education campaign can increase customer and public awareness and behavior of cybersecurity.

2.3 Hypothesis development

2.3.1 Perceived content quality and user satisfaction

Previous research has examined the relationship between perceived content quality and user satisfaction [32-34]. When users judge that educational video content related to cyber security is accurate and reliable, users will feel safer in using mobile banking services [32]. In addition, scenarios in cyber security education videos developed from real cases and can be verified, users tend to be more confident that they are receiving the correct information [33]. Ultimately, users who have watched educational videos about cyber security find the content useful and relevant, they will feel satisfied with new insights and a better understanding of how to protect against the threat of cyberattacks [34, 35]. Thus, this study posited the hypothesis as follows:

H₁: Perceived Content Quality positively affects user satisfaction

2.3.2 Perceived social influence and user satisfaction

Previous research has examined the relationship between social influence and user satisfaction [36-38]. Social media provides access to educational content to increase users' knowledge and confidence in protecting themselves online [36]. Enhanced user preparedness in addressing cybersecurity risks resulting from exposure to social media information tends to positively influence their satisfaction with their choice to utilize mobile banking services [37]. In addition, the inclusion of social media platforms in facilitating social connection and engagement within friend groups is exerting an impact on the acceptance of mobile banking, particularly by means of recommendations and dissemination of cybersecurity educational videos [38]. This social influence can increase their perception of the security and benefits of mobile banking services, thereby increasing their satisfaction [39]. Thus, this study posited the hypothesis as follows:

H₂: Perceived Social Influence positively affects user satisfaction

2.3.3 Perceived entertainment and user satisfaction

Previous research has examined the relationship between perceived entertainment and user satisfaction [39-42]. When users enjoy educational video content about cyber security, the absorption of information will be more effective [40]. Perceived entertainment can be influenced by attractive visuals, a compelling storyline, the right use of humor, and interactive delivery [40, 41]. When all aspects of entertainment perception are fulfilled, users will pay more attention and understand the message conveyed [42, 43]. This will encourage users to apply the information they get from the videos to their daily practices, ultimately increasing their satisfaction with mobile banking [39]. Thus, this study posited the hypothesis as follows:

H₃: Perceived Entertainment positively affects user satisfaction

2.3.4 User satisfaction and cyber attack awareness

Previous research has examined the relationship between user satisfaction and cyber-attack awareness [44-47]. High satisfaction with educational content about cyber security will increase awareness of cyber threats [44]. A good cyber security education video requires relevant and up-to-date content design, clear and simple storytelling, and the right duration [45, 48]. Satisfied customers tend to receive new information submitted by the bank [46]. For example, satisfaction with education about threats and mitigation of potential phishing attacks through social media will add to the positive customer experience when using digital banking services [49]. In addition, customers are also motivated to learn and follow additional security measures to be safer using digital banking services [47]. Thus, this study posited the hypothesis as follows:

H₄: User satisfaction positively affect cyber-attack awareness.

2.3.5 Transaction risk perception and customer trust

Previous research has examined the relationship between transaction risk perception and customer trust [8, 14, 50, 51]. The higher the customer's concern about the security of the transaction, the lower the customer's trust in digital banking services [14]. When customers feel that mobile banking services are not safe due to the potential for data theft or unauthorized access by hackers, phishing threats, and malware threats, then they will be reluctant to use the service [8, 51]. If banks fail to convince customers that their digital services are secure, then customers will choose to avoid using mobile banking or switch to conventional banking [50]. Therefore, customer confidence in the security of banking transactions is influenced by the bank's ability to manage and reduce transaction risk perception [14]. Thus, this study posited the hypothesis as follows:

H₅: Transaction risk perception negatively affect customer trust

2.3.6 Cyber-attack awareness and customer trust

Previous research has examined the relationship between cyber-attack awareness and customer trust [8, 35, 44, 51, 52]. The use of cyber security education videos to enhance consumer knowledge of the potential of cyber assaults can increase customer trust to believe in the security measures that have been implemented by the bank [8, 44]. When customers understand that banks are the target of cyberattacks, customers will be worried about the security of their data [10]. In addition, when customers understand the source of the threat of cyberattacks and how to protect themselves from cyberattacks, customers will trust digital banking services [51]. Ultimately, knowledge and experience of the threat of cyberattacks is an important factor in building customer trust [35]. This is due to transparency on the threat and impact of cyberattacks and how banks are committed to mitigating and responding to such cyberattacks [53]. Thus, this study posited the hypothesis as follows:

H₆: Cyber attack awareness positively affect customer trust

2.3.7 Cyber security measures and customer trust

Previous research has examined the relationship between cyber security measures and customer trust [8, 54, 55]. When customers know that the bank has taken appropriate security measures against cyber threats, customers are more confident in the digital banking services offered [8, 56]. Banks that proactively communicate the security protocols required of customers can enhance customer understanding and compliance with these measures, thereby contributing to increased confidence in the bank's ability to protect them from cyber threats [55]. Utilizing educational video content on cybersecurity promotes the use of robust passwords, adoption of two-factor authentication, and avoidance of divulging personal information to unfamiliar persons can alleviate fears and improve customer satisfaction [54]. Thus, this study posited the hypothesis as follows:

H₇: Cyber security measures positively affect customer trust

2.3.8 Customer trust and commitment

Previous research has examined the relationship between customer trust and commitment [37, 49, 57, 58]. When customers have strong trust in their banks, their commitment to continue using digital banking services is even stronger [37]. Conversely, when trust in digital banking services is lost, customer commitment can be reduced as customers feel insecure and disappointed after a cyberattack [49]. Cyber security education videos designed to strengthen customer trust can help mitigate negative impacts by demonstrating banks' efforts to improve and improve security after an incident [58]. Therefore, it is important for banks to use effective cyber security education videos to maintain and restore customer trust, so that their commitment to digital banking services remains strong [57]. Thus, this study posited the hypothesis as follows:

H₈: Customer trust positively affect commitment

Figure 1 shows the proposed research model. The model was developed based on the utilization of Trust - Commitment Theory in the context of mobile banking usage post cyber-attack risk. The researchers extend the Trust - Commitment theory with the transaction risk perception, cyber attack awareness, cyber security measures, and the customer motivations of consuming cyber security awareness educational content.

501.jpg

Figure 1. Research model

First, the researchers perform data screening using the standard deviation function in Ms. Excel to ensure the data quality [70]. The researchers collect 282 data and remove 23 data. Therefore, the researchers used 259 data for final analysis. Table 1 presents a descriptive analysis of the respondent profile. Based on the age group, 103 respondents (39.8) were between 25 and 35 years old, 118 respondents (45.7%) were over 35 years old, and 37 respondents (14.4%) were under 25 years old. Based on the marital status, 168 respondents (65%) are married, and 90 respondents (34.9%) are still single. Based on the education background, 212 respondents (82.1%) have completed a bachelor's degree, 22 respondents (8.1%) have completed a master's degree, 13 respondents (5%) have completed high school or equivalent, and 11 respondents (4.2%) have completed a diploma degree.

Table 1. Descriptive analysis of respondent profile

Next, the researcher performs a common method bias to ensure the reliability and robustness of findings [71]. This is due to research that relies on survey data where the variance produced in the study is caused by the data collection method rather than the measured construct. The researcher conducted a collinearity test using SmartPLS, the cut-off value used was less than 3.3 [72]. The researcher created a dummy variable and conducted a regression analysis to test all the research variables against the dummy variable. The results of the collinearity test are presented in Table 2. The internal VIF measurement is in the value range of 1,065 (social influence) to 1,880 (cyber-attack awareness). This indicates that the bias procedure does not affect the accuracy of the results of the study.

Next, the researchers perform the data normality test by examining skewness and kurtosis values from SmartPLS software [66]. The cut-off value for skewness and kurtosis values are ± 1 [73]. Table 3 shows the normality test results using skewness and kurtosis value. Most indicators did not meet the criteria for normality test. Therefore, the researchers conclude that the data is not normally distributed. The SmartPLS usage allows the researchers to perform the data analysis even if the data is not normally distributed [74]. However, the researchers need to perform bias-corrected and accelerated bootstrapping (BCa) to ensure that the highly skewed or kurtosis data does not affect the PLS estimate [75].

The researchers examine confirmatory factor analysis by evaluating individual reliability, convergent validity, and discriminant validity [76]. Table 3 shows individual reliability, convergent validity, and internal consistency reliability. First, the researchers evaluate individual reliability using outer loading value. the cut-off value of outer loading is 0.6 [66]. The researchers conclude that 25 indicators meet the cut-off value with a range from 0,618 (CA2) to 0,925 (US2). Second, the researchers inspect internal consistency reliability using composite reliability (CR). The cut-off value of CR is 0.7 [66]. The researchers conclude that all variables meet the CR criteria ranging from 0,747 (Cyber-attack awareness) to 0.905 (Entertainment). Third, inspect the convergent validity using the Average Variance Extracted (AVE). The cut-off value of AVE is 0.5 [66]. Therefore, the researchers conclude that all variables meet the criteria ranging from 0.525 (Cyber-attack awareness) to 0.827 (Entertainment).

Discriminant validity is the final stage of confirmatory factor analysis and is essential for examining the connection between latent variables, grouped as a subcategory of construct validity [66]. The researchers employ Fornell-Larcker criterion for evaluating discriminant validity evaluation [77]. The justification for the selection of these criteria is because the criteria are more pragmatic and easier to understand. The researchers compared the square root of the Average Variance Extracted for each construct with the correlation between the constructs. Table 4 shows the discriminant validity analysis using Fornell-Larcker criterion. Based on the findings, the researchers conclude that the results of the discriminant validity test have met the criteria.

Next, the researchers examine the path analysis using bootstrapping features. The bootstrapping parameter is as follows: One-tailed test, sub-sample size is 5,000, bias-corrected and accelerated (Bca) bootstrap, and significance level 5%. Moreover, the f² statistics were used to demonstrate the impact of independent variables on the dependent variables. Different levels of effect are presented as follows; high (f² > 0.350), moderate (f² > 0.150), and small (f² > 0.020) [78]. Table 5 shows the hypothesis test result.

Based on the hypothesis testing results, content quality (H₁, β = 0.390, t-stat = 3.810, small effect) and social influence (H₂, β = 0.184, t-stat = 2.854, small effect) positively affect user satisfaction. However, entertainment (H3, β = 0.112, t-stat = 1.078, no effect) was not significant. User satisfaction positively affects cybersecurity awareness (H₄, β = 0.418, t-stat = 6.726, moderate effect). Moreover, cybersecurity measures (H₇, β = 0.490, t-stat = 6.386, moderate effect) and cybersecurity awareness positively affect customer trust (H₆, β = 0.160, t-stat = 2.690, small effect). However, transaction risk perception negatively affects customer trust (H₅, β = -0.177, t-stat = 3.584, small effect). Finally, customer trust negatively affects commitment (H₈, β = -0.251, t-stat = 4.304, small effect).

Table 2. Full collinearity estimate

Table 3. Normality, individual indicator consistency, convergent validity, and internal consistency reliability

Table 4. Discriminant validity Fornell-Larcker criterion

Table 5. Hypothesis test results

Table 6. PLS predict

The final procedure of assessing the structural model included the evaluation of its predictive capability using PLS Predict [68]. Table 6 shows the PLS predict results. Our research applied a 10-fold cross-validation method with ten repeats as experimental design. To demonstrate prediction skills, the RMSE value of the PLS-SEM model must be lower than that of the linear regression model (LM). If all Δ PLS-SEM-LM_RMSE values are negative, the model has a significant level of predictive capacity. If most Δ PLS-SEM-LM_RMSE values are negative, the model is considered to have a modest level of predictive capacity. If few or none of the Δ PLS-SEM-LM_RMSE values are negative, the model has low predictive capability. In this case, all Δ PLS-SEM-LM_RMSE values are negative, indicating that the PLS-SEM model's RMSE values are consistently higher than those of the linear regression model for all commitment indicators (CO1 - CO4). This finding demonstrates that the model has excellent predictive capability. Specifically, the negative Δ PLS-SEM-LM_RMSE values suggest that the PLS-SEM model predicts the commitment variables better than the linear regression model.

Hypotheses Discussions

First, the result shows that content quality (H₁ accepted) and social influence (H₂ accepted) positively affect user satisfaction. This finding is consistent with the previous research [32-38]. This shows that the quality of content to educate bank customers to avoid online fraud increases the satisfaction of the responses involved in this study. Content "don't know? Kasih No!" provides useful education so that bank customers are always careful before downloading files from suspicious or unofficial sources so that bank customers can maintain personal security. When associated with respondent profiles, respondents with younger age groups and higher education tend to appreciate the quality of relevant and comprehensive content so that it can increase user satisfaction. However, married respondents and older age groups prioritize content that is relevant to family life and informative. Therefore, the researcher concluded that the higher the quality of educational content, the higher the user satisfaction.

Meanwhile, from the perspective of social influence, bank customers will be interested in interacting after watching educational advertisements because of their innovative, simple, planned and unique content packaging strategies. After customers give likes and comments on the educational content, customers who are satisfied with the educational content will share the post with their relatives. Customers can discuss preventing online crime by commenting on the educational ad post. When associated with respondent profiles, younger and unmarried age groups tend to be influenced by recommendations from friends, family or online reviews that reinforce the relationship with user satisfaction. In addition, respondents with lower education are also more susceptible to the influence of recommendations from friends, family, or online reviews, thereby increasing user satisfaction. Therefore, the researcher concluded that the higher the social influence, the higher the user satisfaction.

However, the relationship between entertainment and user satisfaction is not significant (H₃ rejected). This finding argues the previous research findings [39-42]. Based on the contradictory findings in the study, the researcher suspects that the main purpose of the content is to educate customers on how to prevent online crime through data theft and the spread of viruses through apps from suspicious sources. In addition, the main character of this educational content is a legendary comedian who reminds that Dono and Kasino are close friends so that if someone claims to be a close friend of Indro and sends a virus in the form of an invitation via WhatsApp, Indro will not be fooled. In the end, if the title of this educational content is pronounced, it will remind the audience of the late Dono and Kasino. Finally, the older age group, married, or highly educated groups of respondents focus more on informative or educational content so the relationship between entertainment and user satisfaction may be weaker.

The relationship between user satisfaction and cyber-attack awareness is significant and positive (H₄ accepted). This finding supports the previous research findings [42, 79, 80]. The researchers concluded that customer satisfaction after watching educational content about online crime prevention by stealing identity through text messages or advertisements from suspicious sources can increase cyber-attack awareness. Educational content presented in a clear, informative, relevant, and innovative manner can help customers understand the threat of cyberattacks and the steps they can take to protect themselves. When considering younger age groups and higher education, users tend to be more aware of cybersecurity if they are satisfied with educational videos related to cyber attacks. In addition, married respondents are aware of cyber potential if they are satisfied with educational videos to prevent cyber attacks.

There are positive relationships of cyber security measures (H₇ accepted) and cyber-attack awareness (H₆ accepted) on customer trust. These findings are consistent with previous research findings [8, 35, 44, 51, 54, 55]. The researchers concluded that customers who understood the risks of cyberattacks and realized that their banks had strict security measures in place, felt more secure and trusted in the protection of their personal data and financial transactions. When associated with demographic profiles in measuring the cyber security measures, respondents in older and married age groups tend to be more concerned about cybersecurity, thus strengthening the relationship between security awareness and customer trust. However, respondents who have higher education are more aware of security risks and are more critical in protecting data. Finally, the researchers also evaluate the insight of demographic profiles when measuring the cyber attack awareness. The findings show that younger and more educated respondents tend to be more aware of the risk of cyber attacks, thus strengthening cyber security awareness and customer trust. However, married respondents are more worried about protecting family data so that they can strengthen the relationship [81]. Therefore, the importance of awareness of cyber-attacks and cyber security measures can increase the trust of bank customers in Indonesia [56].

Our research finding shows that perceived risk of transaction negatively affects customer trust (H₅ accepted). These findings are consistent with previous research findings [8, 14, 50, 51]. The researchers conclude that the bank customers feel high potential risks related to data security and banking transactions, customer trust in banks tends to decrease. This risk perception can be obtained by customers through media reports on data leaks, the experiences of other customers affected by online crimes, and the low transparency of the bank in the event of a cyberattack. Based on the demographic profile, older and married respondents tend to be more worried about transaction risk. Meanwhile, respondents with higher education can understand and consider risk factors in transactions. Therefore, bank management needs to proactively manage and reduce risk perceptions by providing transparent and educational information on the security measures that have been implemented.

Our findings shows that customer trust negatively affect commitment (H₈ accepted). This finding argues the previous research findings [10, 57, 58, 62, 82, 83]. Researchers suspect that customer commitment to banks remains high even though bank customer trust has declined after cyberattacks. Moreover, older and married respondents value commitments built on trust. However, respondents who have higher education will demand a stronger commitment from those they trust. This is due to the bank's ability to respond to attacks quickly, transparently, and effectively so that it can prevent customers from losing trust in the bank. When bank management is proactive in communicating with their customers through various communication channels to explain the steps taken to mitigate attacks and improve security, customers will feel valued and prioritized.

This research is also implemented with the IPMA method to enhance the understanding of PLS-SEM results and facilitates the identification of crucial areas for improvement. Using the IPMA approach improves comprehension of PLS-SEM results and makes it easier to identify critical areas for development [69]. Figure 2 presents the Importance performance map analysis results. Prior research had stated that the IPMA offers valuable insight in assisting company in identifying various attributes that are crucial for improvement [84]. In the IPMA results, customer trust and cybersecurity measures are in quadrant of low priority, depicting a positive impact but impractical. Meanwhile, content quality and entertainment are in quadrant of keeping up the good work, means both indicators are already good and should be maintained. The cyber-attack awareness, social influence, transaction risk perception, and user satisfaction are in quadrant of concentrate here, depicting areas for improvement. Finally, the researchers perform important performance map analysis for strengthening the PLS SEM results and facilitate the important factors for improvement [69]. Figure 2 shows the IPMA of security behaviour intention. The researchers classify security awareness, self-efficacy, perceived vulnerability, and threat awareness in quadrant II (concentrate here). Moreover, the perceived severity falls in quadrant IV (possible overkill) and response efficacy falls in quadrant III (low priority).

502.jpg

Figure 2. Importance performance map analysis results

Finally, the management required to prepare and implement detection and curration approach when the prevention failed to protech the organization from hacker attack. Management need to invest for security tools analyst such as data and system backup, incident response, threat detection, and perform risk analysis periodically.

Based on the IPMA result, the researchers proposed several suggestions to the management. Regarding the cyber-attack awareness strategic initiative and its satisfaction, the researchers suggested that the top management should focus on developing relevant and easy to understand education content based on real case study of cyber security threat in banking context. The education content consists of real case examples, risk management and mitigation plan, practical tips that developed using various media formats such as short videos, articles, infographics, webinars, and podcast.

Next, the cyber-security team needs to partner with cyber-security experts or independent organizations to get the latest developments regarding cyber threats and how to deal with them. Based on their insight, the top management should implement cutting edge security technology for reducing the transaction risk. Those security technologies need to be communicated to their bank customers to reduce the cyber-attack risk and protect the financial transaction. Using digital marketing technology and personalized marketing campaigns, the bank management will be able to design personalized educational marketing campaigns to its customer for the risk of cyber-attack.

Next, the cyber security strategic initiative implementation will enhance the detection and curation capabilities for overcoming the cyber-attack risk. The cyber-attack threat detection strategies are the implementation of monitoring system to detect and analyze real-time financial transaction for suspicious transaction patterns, the implementation of big data analytic technology for classifying anomalies in customer transactions, the implementation of intrusion detection system will help cyber-security to monitor network traffic and detect any potential threat, and conducting periodic system and network activity logs assessment for identifying new potential threat.

Based on the cyber security detection outcome, the top management will be able to develop effective responds for threat source isolation and system recovery after cyber-attack happened. The cyber-security team must regularly execute the data recovery procedure to recover the system after cyber-attack happened. Moreover, the cyber security team need to ensure the security systems updated to prevent any security gaps and develop mitigation plan. Finally, the top management need to allocate training budget for updating the employee knowledge related to cyber-security threats and how to mitigate the cyber-attack risks.

Lastly, the top management should evaluate the cyber-security initiative and its education campaign using digital marketing periodically. In certain cases, the cyber security team might enforce the security implementation for ensuring the safety of customers’ financial transactions. Moreover, evaluating and reformulating the educational campaign to ensure the effectiveness of an educational marketing campaign is important.