KBA

KBA verifies identity by asking questions only the real person should be able to answer, such as a previous address or a mother's maiden name. It was once common for account recovery and identity proofing, but data breaches and social media have made the answers easy for attackers to find or buy. NIST now discourages it for identity verification, pushing organizations toward stronger evidence-based methods.