Our users change their password on the same day every month.

We analyzed password change events across 22,000 accounts over 18 months.

Changes clustered on day 1–3 of the month: 47% of all changes

Changes clustered on the same weekday: Tuesday and Monday, 61% combined

Median days between changes for users who changed repeatedly: 31

People were not changing passwords because of a security event. They were changing them on a schedule, often the same schedule, likely because another system required it or because they had a monthly routine. Our security prompts, which fired every 90 days, were arriving at arbitrary times and being ignored or dismissed.

We stopped sending timed password prompts entirely and instead surfaced a security checkup on the first login of each month. Password-related support tickets dropped 29%, and voluntary security checkup completion rose 41% because we stopped competing with a habit we did not create.

What user behavior are you trying to change that is actually already a habit you could ride instead?