The Problem with Security Questions — Why They Weaken Account Security

What security questions are and why they were invented

Security questions are a secondary authentication mechanism used for account recovery: "What was the name of your first pet?", "What street did you grow up on?", "What is your mother's maiden name?" They were designed for a simpler era of internet — a time when personal information was not routinely aggregated, scraped, and sold; before social media made it trivial to discover someone's hometown, high school, pet's name, and family structure from a public profile.

Why security question answers are not secret

The core problem: security questions are supposed to be things only you know, but they are actually things that many people know — or can easily find out. Your mother's maiden name can appear on your parents' wedding announcement, on genealogy websites, in your own social media bio if you mention your family. Your childhood street may appear in old social media posts, local news articles or other public records. Your first pet's name is something childhood friends know and something you may have mentioned online repeatedly.

How attackers exploit security questions

Account recovery exploits: an attacker who knows your email address tries account recovery on a site, answers the security question using publicly available information, resets your password, and locks you out. This is how several high-profile account takeovers have occurred — including the compromise of then-Governor Sarah Palin's Yahoo account in 2008, where the attacker reset the password after answering her security questions (her birth date, ZIP code and where she met her husband) with information found through Wikipedia and Google. Social engineering: attackers call customer support, answer security questions, and instruct support staff to change the account email and password.

The right way to handle security questions

Treat security question answers as additional passwords, not as factual answers. When a site requires a security question, enter a random string generated by your password manager as the "answer." Store this random answer in your password manager alongside the login credentials. This makes the security question cryptographically strong (the answer is random and not guessable) while remaining usable (you can retrieve it from your manager). The answer to "What was your first pet's name?" can be "g7Kp!mQz4vL9" — the site does not verify it against any external reality.

When you cannot avoid security questions

Some sites, particularly banks and government services, require genuine security questions and verify that you can answer them correctly when calling customer support. In these cases, use the random answer approach and note in your password manager record that "security question answers are in notes." If you might have to read an answer aloud to a support agent, choose a short, pronounceable random phrase, such as two random words, rather than a symbol-filled string. For sites where you must genuinely know the answer (because you may need to call and verify verbally), use a consistent but private and unusual answer — not a lie, but a specific personal detail that is not publicly known.

Better alternatives: what should replace security questions

Security questions are an outdated mechanism: NIST's guidelines (SP 800-63B, first published in 2017) already told services not to prompt users to rely on knowledge-based questions such as "What was the name of your first pet?", and the 2025 revision (SP 800-63B-4) repeats that rule. Better alternatives: email-based account recovery (send a reset link to your registered email — requires email security to be strong), phone-based recovery (SMS code — better than security questions, but vulnerable to SIM swapping), authenticator app recovery codes (store backup codes in your password manager), hardware security key backup, and passkeys. If a site still uses security questions as a primary recovery mechanism in 2026, that is a signal about the site's overall security investment. Use the random answer approach and treat that account as lower-trust.

What the research says

The weakness is not only theoretical. A study by Google researchers, "Secrets, Lies, and Account Recovery", examined the use of personal knowledge questions at Google and concluded that they offer much weaker protection than passwords. They found that around 40% of English-speaking US users could not recall their own answers when they needed account recovery, far worse than SMS reset codes, which worked more than 80% of the time. About 37% of users admitted to making up answers, but those invented answers tended to follow predictable patterns, so the effort made them less memorable without making them meaningfully harder to guess. The authors concluded that security questions should not be used as a standalone recovery method.

The practical lesson is the same as the advice above: a security question is only as strong as the answer you give, and the safest answer is one that has no connection to your real life at all.