State of IAM Survey

Free Demo Contact
Are Security Questions Secure? Risks & Alternatives

Are Security Questions Secure? Risks & Alternatives

Security questions are used to verify someone’s identity, for example when resetting a password or during important transactions. How these security questions work, what the advantages and disadvantages are, how to use them securely, and whether there are alternatives. We address these points below.

authenticatiefactorenA security question is one possible authentication factor used to verify someone's identity. Authentication factors fall into three categories:

Factor type

Examples

Something you know

Password, PIN, security question answer

Something you have

Smartphone, hardware security key such as a YubiKey

Something you are

Fingerprint, facial recognition, iris scan

Security questions belong to the first category. Unlike a password or PIN, which is randomly generated or chosen by the user and must be memorised, a security question is a personal question the user can always answer from memory. The name of your first pet, for example, is not something you forget. That reliability is useful, but it comes with a significant security trade-off.

Security questions are typically used as a last resort: when someone has forgotten their regular password and other authentication methods are unavailable. They also appear as an additional verification step for sensitive actions, such as a financial transaction or a medical appointment, where a user must answer a question before proceeding.

Why Security Questions Are Vulnerable

Knowledge factors, meaning anything in the "something you know" category, are inherently the weakest category of authentication. Passwords and PINs can be guessed, leaked, or stolen. Security questions carry additional risk on top of that.

The strength of a security question is that the answer is something you naturally know and would never forget. The weakness is that this same information is often not truly private. In the current online environment, a significant amount of personal data is publicly accessible through social media profiles, genealogy websites, electoral roll data, and other sources. A determined attacker does not need to guess; they can often find the answer.

Types of Security Questions

There are two main types:

Pre-defined personal data. Some security questions use information already held by the organisation, such as a date of birth or account number. These can be applied immediately without asking the user to set anything up.

User-defined questions and answers. Others ask the user to choose from a list of questions and set their own answer at account creation. If identity verification is required later, the system presents the question and checks the response against the stored answer.

Poor vs Good Security Questions

Not all security questions carry the same risk. The quality of the question determines how easily an attacker can defeat it.

Poor security questions

Question

Why it fails

Date of birth

Publicly available via social media, public records, and data brokers

Favourite colour

Easily guessed; most people choose blue

Mother's maiden name

Readily obtainable through genealogy websites and public records

Favourite sports team

Usually findable online; guessing based on location or social media often succeeds

Good security questions

Question

Why it works

Name of your first pet

Hard to find unless the user has posted about it publicly

Favourite teacher at primary school

Exists only in personal memory with no public record

Make and model of your first car

Specific, memorable, and not publicly recorded

A good security question should meet three criteria: the answer must be hard to guess or find online; it must remain stable over time; and it must be unambiguous. Favourite series or music preferences change. An unusual artist name may be difficult to type consistently a year later. Your first pet's name does not change.

How Secure Are They in Practice?

Used in isolation, security questions are always vulnerable. The personal information they rely on can be discovered through social engineering, guessed through common patterns, or found through brute-force attempts. Every business process that uses a security question should ask whether a better alternative exists.

At the same time, they cannot always be avoided. Legacy systems often include security questions as the default mechanism for password recovery. And where all modern authentication methods have failed simultaneously, a security question may genuinely be the only remaining option.

How to Make Security Questions More Secure

The question itself matters, but so does the answer. For experiential or preference-based questions, there is nothing stopping a user from making the answer slightly more complex. If your primary school was Greenfields, you could set your answer as Greenfields123. You are not required to give a factually accurate answer either: inventing an answer makes it harder to find, though it also introduces the risk of forgetting it.

Best practices

  • Use unique answers across applications. Just as passwords should never be reused, security question answers should differ across services.

  • Consider using complex or fictionalised answers. This makes the answer both unique and harder to discover, at the cost of being harder to remember.

  • Store answers in a password manager. This resolves the memory problem that fictionalised answers create and means you can make answers as complex as you like.

  • Limit personal data shared on social media. Information shared publicly is information that can be used against security questions. This applies beyond security questions: digital fraud almost always begins with profiling a target from their online presence.

  • Use multiple questions where possible. Two security questions are significantly more resistant than one. This is usually feasible because they are only used in exceptional circumstances such as password recovery.

  • Store answers hashed, not in plain text. Organisations storing security question answers must treat them with the same care as passwords: never in plain text, always as a cryptographic hash.

  • Enforce answer quality requirements. Apply minimum length requirements and block commonly used terms to prevent trivially weak answers.

Better Alternatives to Security Questions

The best approach is to minimise the use of security questions wherever possible. Modern authentication provides more secure and more user-friendly alternatives.

The NCSC now recommends passkeys as the preferred authentication method, stating they are at least as secure as, and generally more secure than, pairing the strongest password with two-step verification. All GOV.UK services are moving to FIDO-based passkeys as the default login, replacing SMS-based two-factor verification. Cyber Essentials 2025 formally recognises passkeys as compliant access controls, enabling organisations to certify without relying on legacy authentication methods such as security questions.

Within HelloID, the Access Management module supports Multi-Factor Authentication using a smartphone authenticator or a hardware security key. With MFA in place, password recovery via a security question is unnecessary: users receive a recovery link by email and confirm it using their authenticator app or security key.

Three further measures reduce dependence on both passwords and security questions:

  • Single Sign-On (SSO). Users authenticate once with a single master password and gain access to all connected applications, eliminating the need for multiple passwords that might each require their own recovery question.

  • Password manager. For remaining standalone passwords, a password manager means users never lose a password and never need a fallback recovery method.

  • Passkeys. Where applications support them, passkeys replace passwords entirely using cryptographic key pairs and biometric authentication. No password, no security question, no shared secret of any kind.

In modern IAM environments built around SSO, MFA, and passkeys, security questions serve a role only as a final fallback. For most organisations, that role is already smaller than it has ever been.

Are security questions still widely used?

Yes, particularly in legacy systems and older web applications where they were built in as the default recovery method. In modern IAM environments with SSO and MFA, they are increasingly rare. The NCSC and other security authorities actively encourage organisations to move away from knowledge-based authentication wherever alternatives are available.

What makes a security question strong?

A strong security question has three properties: the answer does not appear in any public record or social media profile; the answer remains stable over many years; and the answer is unambiguous, meaning the user will type it the same way every time. Questions about personal history that exist only in memory tend to score well on all three criteria.

Can a password manager help with security questions?

Yes. Storing security question answers in a password manager solves two problems at once. It means you can use fictionalised or complex answers without the risk of forgetting them, and it keeps all credentials, including recovery answers, in one encrypted location rather than scattered across systems.

What is the difference between a security question and MFA?

A security question is a knowledge factor: something you know. MFA combines two or more different factor types, typically something you know (a password) with something you have (a smartphone or hardware key) or something you are (a fingerprint). MFA is significantly more resistant to attack because compromising one factor is not enough to gain access.

Are passkeys replacing security questions?

Effectively yes, in modern environments. Passkeys replace passwords using cryptographic key pairs tied to a device and protected by biometric authentication. Because there is no shared secret to forget, steal, or guess, the fallback mechanisms that security questions were designed to support become unnecessary. The NCSC now recommends passkeys as the default authentication method where they are supported.