---
title: "Never use security questions · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/no-security-questions
updated: 2026-10-20
licence: "All rights reserved"
---

# Never use security questions

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Avoid
- Chapter: [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)
- Rule: Never use security questions, or facts such as a birth date or the last digits of a card, to sign in or recover an account.
- How: Answers are guessable or easy to find online, and NIST SP 800-63B-4 forbids knowledge-based authentication. Use recovery codes, a second factor or the process in [plan for losing every factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors) instead. Remove existing questions and delete the stored answers.
- Check: Search the schema and the code for names such as `security_question`, `secret_answer` or `maiden`. Nothing matches.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/no-security-questions`.

- Previous: [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications)
- Next: [Let organisations require a second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/org-mfa-policy)
- [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)