The End of Security Questions: Why KBA is Dead

Figure 1: The decline of static knowledge credentials

Reviewed and corrected 8 September 2026.

The “Mother’s Maiden Name” Paradox

For 30 years, banks and telcos have relied on Knowledge Based Authentication (KBA).
“What was your first car?”
“What street did you grow up on?”

In 2010, this was “secret” info.
In 2025, much of it is public.

The LLM Scraping Threat

Generative AI agents can scrape years of social media history in seconds.

That photo of your first Honda Civic on Instagram (2014)? The answer is online.
That “Throwback Thursday” post about your childhood home? So is that one.

Static vs. Dynamic Credentials

Passwords and answers are static. Once stolen or guessed, they are valid until changed.
A voice is harder to lift from a database than a password, but it is not immune.

Voice matching can provide an additional identity signal.
Recordings, cloned speech, and compromised voice profiles remain risks, so sensitive actions need additional verification.
NIST’s current digital-authentication guidance (SP 800-63B-4) does not permit voice biometric comparison within its scope, and defines phishing resistance through cryptographic authentication. Do not treat voice matching as phishing-resistant authentication.

The Cost of Friction

Security questions also cost time. Callers forget answers, agents repeat questions, and genuine customers fail checks. Measure this in your own centre: the time it takes to complete KBA, the failure rate for genuine callers, and how often agents override it.

Passive voice matching runs while the caller talks, so it adds no questions. Whether it saves time depends on how often it matches confidently and what happens when it does not.

Moving Forward

The industry is shifting toward “inherence” factors (who you are) alongside “knowledge” factors (what you know). Treat voice matching as one signal in a layered check, not a replacement for every other control.

If your security relies on your customer’s memory alone, add another layer.