Lie, Lie, Lie! Why You Should Never Answer Security Questions Truthfully

What was the name of your first pet? What street did you grow up on? What is your mother’s maiden name? If you answer these honestly, you may be handing attackers a spare key.

Security questions were designed as a backup way to prove who you are. The problem is that the answers are rarely secret. They can be found on social media, genealogy sites, public records, data broker profiles and old breach data. Some are guessable from a short list of popular answers.

The weak link

Why honest answers are dangerous

Think about the quizzes that circulate on social media: “Your superhero name is your first pet plus the street you grew up on!” Those posts are a data collector’s dream. An attacker who knows your answers can sometimes reset your password or convince a call center agent that they are you, completely bypassing a strong password.

A security question is only as strong as the most public fact about your life.

Lie, but lie smart

The fix is simple: treat security questions like extra passwords. Give answers that are false, unguessable and unrelated to the question.

• Use random answers: Your first car could be “Orchid-Tractor-91.” It does not need to make sense.
• Store them in your password manager: Most managers have a notes field for each login. Save the question and your fake answer there.
• Never reuse answers: Each site should get its own made-up answers, just like passwords.
• Watch for phone-based recovery: If you might need to say an answer out loud to an agent, choose random words that are easy to pronounce.
• Skip the quizzes: Avoid social media games that ask for pet names, birthplaces and similar details.

Better yet, reduce reliance on questions. Where a site allows it, use an authenticator app, passkey or backup codes for account recovery instead. Store those backup codes somewhere safe, like your password manager.

A small change that closes a big gap

This takes just a few minutes per account, and you can start with the most important ones: email, banking, mobile carrier and any account that controls money. Your real childhood memories are nobody’s business, least of all a criminal’s.