Security Questions Are Broken: Better Authentication Methods

Security questions like “What is your mother’s maiden name?” and “What city were you born in?” were designed as a fallback authentication mechanism, but they have become one of the weakest links in account security. The answers are often public information, guessable from social media, or shared across multiple accounts. It is time to understand why security questions fail and what to use instead.

Why Security Questions Fail

Answers are publicly available. A 2015 Google study found that 37 percent of people intentionally provide false answers to security questions, but 40 percent of those people then forget their false answers. For those who answer truthfully, the information is often findable on social media profiles, public records, or genealogy sites. Your mother’s maiden name, the street you grew up on, your high school mascot, and your first pet’s name are all commonly shared publicly.

Answers are guessable. The same Google study found that an attacker could guess the answer to “What is your favorite food?” for English-speaking users with a 19.7 percent success rate in a single guess (pizza). “What city were you born in?” has limited options per country. “What was your first car?” has even fewer popular answers per generation.

Answers are static. Unlike passwords that can be changed after a breach, your mother’s maiden name does not change. Once compromised, security questions based on biographical facts are permanently useless.

Cross-account exposure. If you answer “What is your pet’s name?” with “Buddy” on one site and that site is breached, the attacker now has your answer for every other site that asks the same question.

The Sarah Palin Case Study

In 2008, a college student gained access to vice presidential candidate Sarah Palin’s Yahoo email account by answering her security questions. Her birthday, ZIP code, and the answer to “Where did you meet your husband?” were all publicly available information. This incident demonstrated that security questions provide no security against motivated attackers targeting public figures, but the same vulnerability affects anyone whose information is findable online.

Better Alternatives

Password managers with strong, unique passwords. If every account has a unique, randomly generated password stored in a manager like Bitwarden or 1Password, the need for account recovery through security questions is virtually eliminated.

Two-factor authentication as a recovery method. Many services now allow recovery through a second factor (authenticator app, hardware key, or backup codes) rather than security questions. Prioritize services that offer this option.

Recovery codes. A set of one-time codes stored securely (printed and kept in a safe) provides a far more secure recovery mechanism than guessable personal information.

Recovery email or phone. While not perfect (email accounts can be compromised, phone numbers can be SIM-swapped), these are generally more secure than security questions, especially when the recovery email itself is protected with 2FA.

If You Must Use Security Questions

Some services still require security questions with no alternative. In this case, treat the answers as additional passwords: generate random strings in your password manager and store them as the answers. The “answer” to “What is your mother’s maiden name?” becomes “7kX$mPq2vR9nLw.” Store these in your password manager alongside the account’s password.

Never use real biographical information as answers. Never reuse the same answers across different services.

For more on securing the authentication layer, see our two-factor authentication guide. To understand how attackers use personal information gathered from your online presence, explore our social engineering defense guide.

The Future of Account Recovery

The industry is gradually moving away from knowledge-based authentication toward more secure recovery mechanisms. Recovery keys, trusted device networks, and social recovery (where trusted contacts can vouch for your identity) provide stronger security than answerable questions.

Apple’s Account Recovery Contact feature allows you to designate trusted people who can help you regain access to your account. Google’s similar feature uses trusted devices as recovery mechanisms. These approaches leverage something you have (a trusted device or relationship) rather than something you know (an easily guessable answer).

For organizations still requiring security questions, implement adaptive authentication that uses multiple signals (device recognition, location, behavioral patterns) alongside knowledge-based questions. This defense-in-depth approach means a compromised security question alone is insufficient for account access. The trajectory is clear: security questions are a legacy technology being gradually replaced by more secure, user-friendly alternatives.