“What was the name of your first pet?” It usually shows up when you’re already stressed — locked out of an account, clicking through recovery steps — and it feels like the easy question. The answer is sitting right there in your memory. You type it in, move on, and forget it ever happened.
But that innocent-looking question is a password wearing a costume. And answering it honestly is what makes it weak.
Your answers aren’t secrets. They’re facts about you.
A security question asks for something only you should know. The trouble is that the standard questions — your first pet’s name, the street you grew up on, your mother’s maiden name, your first school — aren’t things only you know. They’re facts, and facts leave a trail.
Some of that trail is on social media, where you’ve probably posted photos of that pet, mentioned your hometown, or tagged family members. Some of it sits in public records and data-broker databases. And a great deal of it is in the same breached databases that have been leaking personal details for years. An attacker who wants to reset your password doesn’t have to guess blind — they can assemble your answers the way a journalist would.
This isn’t a theoretical problem. Microsoft Research measured how guessable secret questions were back in 2009, and Google’s own research team later documented that secret questions were both easier to guess than users expected and harder for users themselves to recall reliably. The US National Institute of Standards and Technology has gone further still: its digital identity guidelines (SP 800-63B) tell organizations not to use knowledge-based questions at all. A lock that strangers can pick and owners can forget is a lock in name only.
This is also why security questions show up in real attack playbooks. Social engineers — the people who call helpdesks pretending to be you — gather these answers from social media and public data before they ever pick up the phone, because many helpdesks still accept them as proof of identity. Every honest answer you publish about yourself is one less hurdle for them.
The fix: treat the answer box like a second password
Once you see a security question for what it is — a second, weaker password that most people make guessable — the fix becomes obvious. Give it a wrong answer.
For “What was the name of your first pet?”, type something like blue piano umbrella — a phrase with no connection to your life, as random as you can make it. Anyone researching you will find your actual pet’s name everywhere; it will never lead them to your answer. Your answer is now functionally another password: worthless to an attacker, and something you store in your password manager alongside that site’s login.
Two details matter. First, the answer usually has to match exactly — spaces, capitals and all — so don’t trust your memory. Write the fake answer down in your password manager, right next to that site’s password. Second, keep it unique per site, the same way you keep passwords unique. One reused answer is one reused key.
If a site lets you write your own custom question, that’s better raw material — but only if the answer isn’t discoverable anywhere. “What was the name of the first restaurant you ate at alone?” is fine if the answer exists nowhere online. Even then, the safest play remains a random answer stored in the manager.
Now go back and fix the answers you already gave
Most people have accounts set up years ago with honest answers baked in — old banking portals, tax sites, older email providers, government services. It’s worth spending one sitting to revisit the important ones: sign in, find the security settings, and replace the honest answers with random ones. A few minutes per account, and each one becomes meaningfully harder to break into.
Where you can’t change the questions, add something stronger instead. A second factor — an authenticator app, a security key, even SMS codes — protects the account far better than any answer tweak. And where an account’s only recovery path is a set of questions you can’t change, make sure the recovery email and phone number on the account are yours and current. That’s where the reset actually lands — which is why your email account is the master key to your online life and deserves two-factor authentication of its own.
The same trap is sitting in your social media feed
There’s one more place this habit hurts you: the viral quiz posts. “Your pirate name is your first pet’s name + the street you grew up on.” “Your spy name is your mother’s maiden name + your birth city.” They look like harmless fun, but they harvest exactly the answers people feed to security questions — and they farm out your friends’ answers at the same time.
You don’t need to lecture anyone. But quietly skipping them, and mentioning it once to the family members most likely to fill them out — parents and grandparents use security questions more than anyone — closes a surprisingly common leak.
Security questions feel personal, so people treat them personally. But to a stranger with a search engine, they’re just another thing to look up. Answer them the way you’d answer anything an attacker could read over your shoulder: with something that isn’t true, that you store safely, and that nobody could ever guess. Five minutes per account turns one of the weakest locks on your digital life into one that’s actually worth something. More in our Online Safety section.
