behavioral ux
Back to library

Authority bias

Authority bias is the tendency to read a source's standing as a substitute for evaluating what the source says. Judging an argument is expensive and a badge is cheap to read, so under uncertainty the badge gets used instead.

Invoice 4821 · duplicate check
4,180€ · Brightline Studio · due 18 Oct
Duplicate. Do not pay this invoice.
Assistant
  • Same amount as invoice 4102, paid 3 Oct
  • Same payee and same bank account
  • Different invoice number and date
Nothing is paid until you confirm
Without a confidence level
Invoice 4821 · duplicate check
4,180€ · Brightline Studio · due 18 Oct
Possible duplicate60% confidence
Assistant · tracks its accuracy on your closed checks
  • Same amount as invoice 4102, paid 3 Oct
  • Same payee and same bank account
  • Different invoice number and date
Nothing is paid until you confirm
With a confidence level
Live demo

The canonical citation does not say what the design advice says it says. In Milgram (1963), 26 of 40 participants in a staged learning task went to the shock generator's last switch, labelled 450 volts. That is one condition of 23: Haslam, Loughnan and Perry (2014) pooled 21 of them, covering 740 participants, and found full obedience in 43.6% of cases rather than two thirds, with eight of 14 coded features of the situation independently predicting obedience: it fell with a non-directive or inconsistent experimenter, with group pressure to disobey, and when the learner was closer at hand. Perry, Brannigan, Wanner and Stam (2020) recovered an unpublished analysis in which, across 18 of 23 variations, participants who fully believed they were inflicting pain chose lower shock levels than those who doubted the setup. Gibson (2013) counted every use on the Yale tapes of the fourth and final prod, “You have no other choice, you must go on,” the only line that is an order: used on 23 participants, it produced further shocks from two, one of whom became fully obedient, and the most common reply was a flat rebuttal. There is no obedience rate here to borrow, and nothing in it about a badge on a screen.

Uniforms shift behaviour in small field experiments, without anyone being able to say why. Bickman (1974) had an experimenter dressed as a civilian, a milkman or a guard make a trivial street request. Compliance was higher for the guard, and unaffected by whether he stayed to watch, which points at legitimacy rather than fear of being caught; yet accompanying questionnaire studies found that students “did not perceive the guard as having either more power or more legitimacy than the milkman or civilian.” The other pillar of the popular account, nurses accepting a telephoned drug overdose order, has a published non-replication in Rank and Jacobson (1977). What attire reliably moves is ratings: in Petrilli and colleagues' (2018) patient survey, 53% said physician dress mattered to them and a white coat with formal attire rated highest for knowledge and trustworthiness, though scrubs were preferred for surgeons and patients 65 and over leaned hardest on the coat. That is a preference study about clothes, not evidence that a coat in a product photo sells a subscription.

The best-measured interface version is the trust seal, and the honest summary is small and conditional. Özpolat and Jank (2015) analysed 288,169 transactions across 493 retailers, from field experiments run by a trust seal provider that then shared the data — provenance worth weighing. Seals helped more for small retailers and for new shoppers, substituting for shopper experience and for the seller's own sales volume; they helped on higher-value carts, and only late in the shopping cycle; and showing more than two seals lowered the likelihood of completing a purchase. A badge is a crutch for a store with nothing else to show, not a lever on a store that already has order history and reviews.

The badge also has to be seen and understood, and mostly it is not. Kirlappos, Sasse and Harvey (2012) eye-tracked 60 experienced shoppers: 38% noticed none of the three seals present. Trust ratings rose where a seal was noticed — and when the researchers asked what the seals meant, every stated meaning was wrong, including the belief that a seal's presence “automatically legitimizes any website.” Edelman (2011) shows the cost: across roughly half a million sites, 5.4% of TRUSTe-certified sites were untrustworthy against 2.5% of uncertified ones, while BBBOnLine's certified sites ran the other way, 1.0% against 3.0%. The mark carries almost no information about what a user is trying to judge, and a badge that only asserts identity carries none: across studies of 748 and 2,041 participants, Vaidya, Votipka, Mazurek and Sherr (2019) found a verified-account indicator had no effect on willingness to share or act on a tweet from an unfamiliar account.

A credential can also lose to relatability outright. Alsan and Eichmeyer randomised men without a college degree to vaccine messages from different senders. The lay messengers, rated 0.54 standard deviations less qualified and trustworthy than the physicians, raised stated willingness to take the COVID-19 vaccine by 8.8 percentage points (20%), and 15 percentage points (39%) more reported a flu shot at follow-up — the only arm that differed significantly from the others, on a comparison with substantial attrition. Where trust in the institution is low, pick the messenger your audience resembles over the one with the title.

The large, well documented effect is the failure mode. Goddard, Roudsari and Wyatt (2012) reviewed 74 studies of automation bias — people accepting a system's advice when it is wrong — and Jacobs and colleagues (2021) priced it: 220 antidepressant-prescribing clinicians scored 0.357 on expert concordance unaided, were not helped by correct machine recommendations (0.384), and fell to 0.299 when the recommendation was wrong, below their own unaided accuracy, and to 0.262 when the error carried a feature-based explanation. Confidence did not move with accuracy, and the clinicians most familiar with machine learning scored worst. Buçinca, Malaya and Gajos (2021) show overreliance is reducible — cognitive forcing beat plain explanations — but the designs that reduced it most were the ones participants rated worst. The same cue serves attackers: Williams, Hinds and Joinson (2018) found authority cues in simulated spear-phishing sent to 62,000 employees raised clicks on a suspicious link.

So the tendency is real and the design claim built on it is weak. Pornpitakpan's (2004) review of five decades finds high-credibility sources beating low-credibility ones on average, with interaction studies showing credibility to be “a liability under certain conditions.” The numbers you can trust here describe trust being set wrongly: seals on unsafe sites, confident models degrading expert judgement, authority cues winning clicks for phishing. The defensible build is narrow — one specific, checkable, relevant credential, shown where the doubt is to a user with no other way to judge — and what to measure is whether people believed the right things, not whether they converted.

When it holds

  • The user has no other way to judge. Seals worked hardest for small retailers and new shoppers, substituting for shopper experience and for the seller's own sales volume; a known brand with reviews and a history gains least.
  • Only if the signal is noticed. In the eye-tracking study 38% of shoppers saw none of the three seals on the pages they browsed, and ratings rose only among those who saw one.
  • At the moment of doubt, not on the landing page. The field data puts the seal effect on higher-value carts and in the later stages of the shopping cycle.
  • Up to about two signals. More than two seals lowered the likelihood of purchase completion across 288,169 transactions.
  • Not for badges that only assert identity. Across 748 and 2,041 participants, a verified-account indicator had no significant effect on willingness to share or act on a tweet from an unfamiliar account.
  • Weaker than social proximity where trust is low. Lay messengers rated 0.54 standard deviations less qualified than physicians still moved stated vaccine willingness 8.8 percentage points more.
  • It reverses when the authority is wrong. Incorrect machine recommendations pulled 220 clinicians from 0.357 to 0.299 on expert concordance, below their own unaided performance, and to 0.262 with an explanation attached.
  • It depends on the whole situation, not on the credential. Across 21 Milgram conditions, eight of 14 coded features independently predicted compliance, and obedience fell when the authority was non-directive or inconsistent and when the person being harmed was closer at hand.

How to apply

  • Print the issuer, the scope and the date next to every certification, and link to the issuer's own register so the claim can be checked. A seal that cannot be verified is a picture.
  • Show at most two trust marks, and put them at the payment or data-entry step rather than the home page — that is where the field data locates the effect.
  • Attribute expert content to a named person with a stated qualification and a review date (“Medically reviewed by … , MD, March 2026”), and link the sources behind the claim. Match the field to the claim: a credential in the wrong field is just a title.
  • Show the credential to users who have no other evidence — first sessions, new accounts, unfamiliar categories — and spend that space on order history, reviews and specifics for people who already know you.
  • Quote experts on what only an expert can tell a user, and let customers speak to everything else. Where the doubt is about you rather than about the facts, a messenger who resembles your audience may persuade more than a specialist.
  • On high-stakes AI surfaces, present information rather than a verdict, and attach a confidence level that is updated as the system's record accumulates.
  • Put a verification step in front of consequential AI suggestions: capture the user's own judgement first, or require them to open the evidence before accepting. Expect the satisfaction score to dip for it.
  • Strip authority cues out of your own transactional email and in-product messaging — no fake escalation, no “action required by your administrator.” Every one you send trains the habit an attacker needs.

What to avoid

  • Implying an endorsement you do not have. Annex I of the EU Unfair Commercial Practices Directive makes it unfair in all circumstances to claim “that a trader (including his commercial practices) or a product has been approved, endorsed or authorised by a public or private body when he/it has not or making such a claim without complying with the terms of the approval, endorsement or authorisation” (point 4). A press-logo strip reading “as seen in” over coverage you were never the subject of is this.
  • Displaying a trust mark you are not entitled to display. The same Annex blacklists “displaying a trust mark, quality mark or equivalent without having obtained the necessary authorisation” (point 2), and claiming to be a signatory to a code of conduct when you are not (point 1).
  • An expert endorsement outside the endorser's field. The FTC Endorsement Guides define an expert as someone whose “knowledge of a particular subject … is superior to what ordinary individuals generally acquire” (16 CFR 255.0(e)), and 255.3(a) requires that “the endorser's qualifications must in fact give the endorser the expertise that the endorser is represented as possessing.” The Guides' own example: an endorsement of a car by someone described as an engineer is deceptive if the engineer's field is chemical engineering.
  • Inventing a certifying body, or building one in-house and presenting it as independent. The Guides treat approval by an “American Institute of Science” as deceptive where the institute is not a bona fide independent testing organisation, and deceptive even where it is unless it actually ran valid tests supporting the claim.
  • Buying credibility indicators. The Guides state plainly that it is deceptive to purchase or create indicators of social media influence and use them to misrepresent that influence for a commercial purpose — fake followers, fake verification, fake expert panels.
  • Dressing a self-issued graphic as third-party certification. Shoppers in the eye-tracking study were wrong about what every seal meant, including believing a seal “automatically legitimizes any website”; across half a million sites, certification by the best-known seal was associated with being more than twice as likely to be unsafe.
  • Giving a model's output an authoritative voice it has not earned. Confident wrong recommendations dropped clinicians below their unaided accuracy while leaving their confidence unchanged, and the users most familiar with the technology did worst.

Real-world examples

Starling screen titled Protecting your money, headed Your money will be protected. The text says money is covered by the Financial Services Compensation Scheme (FSCS), which protects up to £120,000 of the money held with Starling in total across all Starling accounts, that compensation comes from the FSCS if Starling cannot pay the money back, and that tapping Continue confirms the FSCS Information Sheet has been received. A row reading FSCS Information Sheet with a chevron sits above a Continue button.
Starling names the scheme behind the promise — money covered by the Financial Services Compensation Scheme (FSCS), protecting up to £120,000 of the money held with it in total — and puts the FSCS Information Sheet one tap away before Continue, so the guarantee arrives with an issuer, a limit and a scope that can be checked.
Crate & Barrel product page section headed Responsible design, below a Reviews row showing 4,5 and four and a half stars. An FSC logo sits beside FSC® Certified, described as products made with sustainable wood from forests certified to be responsibly managed, environmentally sound and socially beneficial. A GREENGUARD Gold logo sits beside GREENGUARD Gold Certified, described as furniture screened for more than 10,000 chemicals and emissions, with an underlined link reading See all GREENGUARD Gold Certified products. A further link reads Learn more about our commitment to Responsible Design, above a quantity stepper set to 1, an Add to Cart button and an Add to Registry button.
Crate & Barrel carries two marks and no more in its Responsible design section, each printed with the body that issues it and what it covers — FSC® Certified for wood from forests certified to be responsibly managed, GREENGUARD Gold Certified for furniture screened for more than 10,000 chemicals and emissions — and links through to every GREENGUARD Gold certified product, so the badge opens onto the certifier rather than ending at a logo.
eBay Item details screen summarised as 1950 Bowman 22 Jackie Robinson. A row with the PSA logo reads Review official PSA data. A Total PSA population grid lists grade 10 as 1, 9 as 12, 8 as 50, 7 as 83, 6 as 140, 5 as 172, 4 as 198, 3 as 236, 2 as 223, 1.5 as 121, 1 as 248 and Auth as 47, with Population of all grades given as 1,769 and Category as Baseball Cards. A note says PSA registry information is based on the certification number depicted in the listing images, that it may differ from seller listing information, and that population data was updated as of Feb 19, 2026. Buttons read Buy similar and List this item.
eBay puts the grader's own numbers on the item — 1,769 copies graded in all, 1 at grade 10 and 248 at grade 1 — under a row reading Review official PSA data, with a note that the population data was updated as of Feb 19, 2026, so the credential comes with an issuer, a scope and a date instead of a seller's word for it.
Flo Insights article headed What can cause late periods and irregular cycles? Under the headline, a portrait photo with a verified badge and a Reviewed By label credit Dr. Lee P. Shulman, Professor of obstetrics and gynecology, Northwestern University, Illinois, US, 30+ years in obstetrics and gynecology. The body text says the absence of menstruation does not necessarily indicate pregnancy and divides other explanations into Physiological, Medical and Pathological categories.
Flo credits the article to a named reviewer directly under the headline — Dr. Lee P. Shulman, Professor of obstetrics and gynecology, Northwestern University, Illinois, US, 30+ years in obstetrics and gynecology — above an explanation of what causes late periods, so the credential is specific and sits in the same field as the claim it backs.
Yuka Product scoring sheet explaining which studies are taken into account. Rows list FDA, Food and Drug Administration; EFSA, European Food Safety Authority; and IARC, International Agency for Research on Cancer, each with a logo and a link icon, followed by Independent studies, Recognized scientific studies. A section headed 3 — The organic nature of the product says an organic product carries an official national or international organic label and avoids chemical pesticides. A footnote says the rating established by the app is an opinion given by Yuka and that the adjectives Excellent, Good, Poor and Bad refer to this score and not to the product directly.
Yuka shows what the product score is built from rather than only its verdict — the FDA, the EFSA and the IARC each named in full with a link out, alongside recognised independent studies — and states underneath that the rating is an opinion and that “Excellent”, “Good”, “Poor” and “Bad” describe the score rather than the product directly.
1 / 5

Measuring it

  • Primary metric: completion at the step where the credential sits, measured against a cell with it removed, split by first-time and returning users. The effect lives in the first group; an average across both will read as nothing.
  • Secondary: whether anyone saw it and what they think it means. Ask for unprompted recall after the task and ask what the badge means in the user's own words — 38% of shoppers missed every seal on the page and every stated meaning was wrong, which is the state in which a real badge is worth nothing and a fake one works.
  • Backfire metric: the signal count. Track completion against the number of trust marks on the page and expect it to fall past two.
  • Backfire metric for AI surfaces: accuracy on the subset of cases where the system is wrong, plus the rate at which users override it. If their certainty does not move when the recommendation is wrong, you have built deference, not support.
  • Backfire metric: refunds, chargebacks, disputes and complaints that cite the claim — “it said it was certified.” A credibility signal that lifts conversion and lifts this at the same time was carrying weight it could not support.

References

For agents

An agent-friendly guide to this principle lives at /agents/authority-bias.md.

Our MCP server and skills for all principles are coming soon.

Similar principles

Disclaimer: The theories here are just that — theories. They may not apply universally and should be considered in context. Use your own judgment and consult additional sources when applying these principles.