Knowledge Based Authentication (KBA)
Knowledge-based authentication (KBA) verifies identity by asking questions only the real person should be able to answer. Also called out-of-wallet questions, it draws on credit files and public records — former addresses, previous lenders, vehicle history — and it no longer works, for reasons that are structural rather than fixable.
| Also called | KBA, out-of-wallet questions, OOW, knowledge-based verification |
| Static KBA | Questions the user chose and answered in advance |
| Dynamic KBA | Questions generated on the fly from credit and public records |
| Typical sources | Credit bureau files, property records, vehicle registrations, public directories |
| Core assumption | That personal data is private |
| Why that fails | Breach data makes the same information available to attackers |
| Genuine-user failure rate | High — people misremember their own history |
| Regulatory position | NIST has discouraged KBA as a standalone factor since 2017 |
| Where it survives | Call centers, account recovery, legacy systems |
How it works
Two variants, and the second was built to fix the first.
Static KBA uses questions the user answered at signup — mother’s maiden name, first pet, the street they grew up on. The weakness is obvious in hindsight: the answers rarely change, they are frequently discoverable on social media, and a user who sets them once may not recall the exact wording years later.
Dynamic KBA generates questions in real time from credit and public records. Which of these four streets have you lived on. Which lender holds an auto loan opened in 2019. What was the monthly payment. The user has never seen the question before, so it cannot be prepared for — which was the point.
Dynamic KBA works exactly as designed and rests on an assumption that is no longer true. The questions come from data brokers and credit files, and that data has been breached repeatedly and comprehensively. A fraudster holding fullz is reading the answers off the same sources the questions were generated from.
The failure is not marginal. It inverts the control. A fraudster reading from a file answers accurately and quickly; a genuine customer misremembers a former address, forgets which of four lenders held a loan six years ago, and fails. KBA performs better for attackers than for the people it is meant to protect.
Why it matters for identity verification
KBA is worth understanding because it is the clearest example of a control invalidated by a change in the world rather than by a flaw in its design.
Every authentication method rests on something: what you know, what you have, what you are. KBA rests entirely on the first, and the premise underneath it — that personal history is private — stopped being true. No amount of better question generation restores it, because the questions and the attacker’s answers come from the same compromised sources.
That is why identity verification has moved to what the person has and what they are. A genuine government-issued document, authenticated, matched to a live face, asks for something a data breach cannot supply. Linking that verified identity across accounts adds the constraint that one face cannot serve fifty identities, and Microblink’s stolen and synthetic identity detection is built on both.
KBA persists in call centers and account recovery, which is precisely where account takeover attacks now aim. An attacker who cannot pass a login flow calls support instead, armed with enough breach data to satisfy the script.
KBA vs document and biometric verification
| Knowledge-based authentication | Document plus biometric | |
|---|---|---|
| Based on | What the person knows | What they hold and what they are |
| Defeated by | Any sufficiently complete data breach | Requires a genuine document and a matching live face |
| Genuine-user failure | High — people misremember | Low, given adequate capture |
| Works for thin-file customers | No — nothing to draw questions from | Yes |
| Time to complete | 1–3 minutes | Under a minute |
| Regulatory standing | Discouraged as a standalone factor | Accepted for CIP and KYC |
The third row deserves attention. KBA does not just fail against attackers — it fails legitimate customers at a high rate, and it fails hardest for people with thin files: young adults, recent immigrants, the underbanked. The control excludes exactly the customers a growing institution most wants to reach.
What it can’t do
It cannot be fixed by better questions. The vulnerability is the data source, not the question design. Any question answerable from records is answerable by whoever holds those records.
It cannot verify anyone with a thin file. No credit history means no questions. The method is structurally unavailable to a substantial and growing share of the population.
It cannot establish presence. KBA over the phone confirms someone knows the answers. It says nothing about who is speaking, which is why it is such a weak control at exactly the point — account recovery — where it is still most used.
It cannot serve as a standalone factor under current guidance. NIST has discouraged KBA as a sole authenticator since 2017. It survives as a supplementary signal and as legacy infrastructure, not as a defensible primary control.
Frequently asked questions
What are out-of-wallet questions?
Another name for dynamic knowledge-based authentication — questions generated from credit and public records rather than from anything in the user’s wallet. Former addresses, previous lenders, vehicle history. The term and KBA describe the same method.
Why is knowledge-based authentication no longer considered secure?
Because it assumes personal data is private, and repeated large-scale breaches made the same records available to attackers. A fraudster reading from a stolen file answers more reliably than a genuine customer recalling their own history.
What is the difference between static and dynamic KBA?
Static uses questions the user chose and answered in advance. Dynamic generates questions in real time from credit and public records, so the user has not seen them before. Dynamic was built to fix static’s weaknesses and is defeated by the same breach data.
What replaced knowledge-based authentication?
Document verification paired with a biometric check, plus device and behavioral signals. These ask for something a data breach cannot supply — a genuine credential held by the matching live person — rather than for information that is now widely circulated.
Related reading
- Fullz — the breach data that supplies the answers
- Account takeover fraud — where KBA is still used and still failing
- Identity document verification — what replaced it
- Underbanked — the customers KBA excludes by design
