Are Security Questions Secure? Risks & Alternatives
Security questions are used to verify someone’s identity, for example when resetting a password or during important transactions. How these security questions work, what the advantages and disadvantages are, how to use them securely, and whether there are alternatives. We address these points below.
A security question is one possible authentication factor used to verify someone's identity. Authentication factors fall into three categories:
Factor type | Examples |
|---|---|
Something you know | Password, PIN, security question answer |
Something you have | Smartphone, hardware security key such as a YubiKey |
Something you are | Fingerprint, facial recognition, iris scan |
Security questions belong to the first category. Unlike a password or PIN, which is randomly generated or chosen by the user and must be memorised, a security question is a personal question the user can always answer from memory. The name of your first pet, for example, is not something you forget. That reliability is useful, but it comes with a significant security trade-off.
Security questions are typically used as a last resort: when someone has forgotten their regular password and other authentication methods are unavailable. They also appear as an additional verification step for sensitive actions, such as a financial transaction or a medical appointment, where a user must answer a question before proceeding.
Why Security Questions Are Vulnerable
Knowledge factors, meaning anything in the "something you know" category, are inherently the weakest category of authentication. Passwords and PINs can be guessed, leaked, or stolen. Security questions carry additional risk on top of that.
The strength of a security question is that the answer is something you naturally know and would never forget. The weakness is that this same information is often not truly private. In the current online environment, a significant amount of personal data is publicly accessible through social media profiles, genealogy websites, electoral roll data, and other sources. A determined attacker does not need to guess; they can often find the answer.
Types of Security Questions
There are two main types:
Pre-defined personal data. Some security questions use information already held by the organisation, such as a date of birth or account number. These can be applied immediately without asking the user to set anything up.
User-defined questions and answers. Others ask the user to choose from a list of questions and set their own answer at account creation. If identity verification is required later, the system presents the question and checks the response against the stored answer.
Poor vs Good Security Questions
Not all security questions carry the same risk. The quality of the question determines how easily an attacker can defeat it.
Poor security questions
Question | Why it fails |
|---|---|
Date of birth | Publicly available via social media, public records, and data brokers |
Favourite colour | Easily guessed; most people choose blue |
Mother's maiden name | Readily obtainable through genealogy websites and public records |
Favourite sports team | Usually findable online; guessing based on location or social media often succeeds |
Good security questions
Question | Why it works |
|---|---|
Name of your first pet | Hard to find unless the user has posted about it publicly |
Favourite teacher at primary school | Exists only in personal memory with no public record |
Make and model of your first car | Specific, memorable, and not publicly recorded |
A good security question should meet three criteria: the answer must be hard to guess or find online; it must remain stable over time; and it must be unambiguous. Favourite series or music preferences change. An unusual artist name may be difficult to type consistently a year later. Your first pet's name does not change.
How Secure Are They in Practice?
Used in isolation, security questions are always vulnerable. The personal information they rely on can be discovered through social engineering, guessed through common patterns, or found through brute-force attempts. Every business process that uses a security question should ask whether a better alternative exists.
At the same time, they cannot always be avoided. Legacy systems often include security questions as the default mechanism for password recovery. And where all modern authentication methods have failed simultaneously, a security question may genuinely be the only remaining option.
How to Make Security Questions More Secure
The question itself matters, but so does the answer. For experiential or preference-based questions, there is nothing stopping a user from making the answer slightly more complex. If your primary school was Greenfields, you could set your answer as Greenfields123. You are not required to give a factually accurate answer either: inventing an answer makes it harder to find, though it also introduces the risk of forgetting it.
Best practices
Use unique answers across applications. Just as passwords should never be reused, security question answers should differ across services.
Consider using complex or fictionalised answers. This makes the answer both unique and harder to discover, at the cost of being harder to remember.
Store answers in a password manager. This resolves the memory problem that fictionalised answers create and means you can make answers as complex as you like.
Limit personal data shared on social media. Information shared publicly is information that can be used against security questions. This applies beyond security questions: digital fraud almost always begins with profiling a target from their online presence.
Use multiple questions where possible. Two security questions are significantly more resistant than one. This is usually feasible because they are only used in exceptional circumstances such as password recovery.
Store answers hashed, not in plain text. Organisations storing security question answers must treat them with the same care as passwords: never in plain text, always as a cryptographic hash.
Enforce answer quality requirements. Apply minimum length requirements and block commonly used terms to prevent trivially weak answers.
Better Alternatives to Security Questions
The best approach is to minimise the use of security questions wherever possible. Modern authentication provides more secure and more user-friendly alternatives.
The NCSC now recommends passkeys as the preferred authentication method, stating they are at least as secure as, and generally more secure than, pairing the strongest password with two-step verification. All GOV.UK services are moving to FIDO-based passkeys as the default login, replacing SMS-based two-factor verification. Cyber Essentials 2025 formally recognises passkeys as compliant access controls, enabling organisations to certify without relying on legacy authentication methods such as security questions.
Within HelloID, the Access Management module supports Multi-Factor Authentication using a smartphone authenticator or a hardware security key. With MFA in place, password recovery via a security question is unnecessary: users receive a recovery link by email and confirm it using their authenticator app or security key.
Three further measures reduce dependence on both passwords and security questions:
Single Sign-On (SSO). Users authenticate once with a single master password and gain access to all connected applications, eliminating the need for multiple passwords that might each require their own recovery question.
Password manager. For remaining standalone passwords, a password manager means users never lose a password and never need a fallback recovery method.
Passkeys. Where applications support them, passkeys replace passwords entirely using cryptographic key pairs and biometric authentication. No password, no security question, no shared secret of any kind.
In modern IAM environments built around SSO, MFA, and passkeys, security questions serve a role only as a final fallback. For most organisations, that role is already smaller than it has ever been.