Practical guide · verified against the real thing
The security-question trap: why your mother's maiden name protects nobody
In one line: America's digital-identity standards body says security questions shouldn't be used for authentication at all — and the reasons are older than the internet.
Security questions survive everywhere — the bank, the email provider, the government portal — which makes them look like protection. They're closer to a spare key buried under a doormat you announced the location of. The US National Institute of Standards and Technology (NIST), whose digital identity guidelines are the reference point for authentication worldwide, now states it plainly: knowledge-based authentication — security questions — is "no longer recognized as an acceptable authenticator", and verifiers shall not use it. The standards body that shapes how banks and governments authenticate people has formally retired the mother's maiden name.
Why the answers were never secret
Three structural problems, all older than the practice itself. Researchability: maiden names, first schools, first cars, the street you grew up on — a surprising amount is one social-media scroll away, and data brokers assemble the rest. Leakability: when any site using the same questions is breached, the answers leak with it — and people recycle answers as readily as passwords. Smallness: even private answers have tiny possibility spaces — how many first-pet names are there, really? A question with twelve plausible answers isn't a lock; it's a twelve-sided die an attacker gets to roll forever.
What NIST says to do instead
The standard's guidance for the sites that still ask: generate random answers and store them in a password manager — not the actual answer, a random string. NIST's own FAQ suggests exactly this. Your mother's maiden name becomes 7-trXq!2mpL-vase-2, the manager remembers it, and the "security question" quietly becomes a second random password — which is the only version of it that ever protected anyone. The password-manager guide covers the setup, and the reuse guide explains why recycled answers leak sideways just like recycled passwords.
If you're locked out instead: the recovery honest path
Sometimes the trap has already sprung — the account demands the question, the answer's long gone. That's an account-recovery problem, not a security one: the forgotten-password guide walks the honest recovery routes, and the lesson afterwards is the random-answers-in-a-manager setup, so the next lockout never depends on remembering which street you lived on in 2009.
The wider pattern worth naming
Security questions are the clearest example of a general rule: authentication that depends on facts about you was never authentication — it was trivia. The modern replacements — generated passwords in a manager, app-based second factors, and passkeys that bind sign-in to a device — all share one property: they don't ask what you know that others might also know. They verify something you have or something unique you hold. Where a service offers those, prefer them; where it still asks for your first school, feed it a random string and sleep better.
Sources: NIST SP 800-63 Digital Identity Guidelines FAQ (KBA no longer recognized; random answers via password manager recommended); NIST SP 800-63B. Reviewed September 2026.
Sources
Next