Knowledge-based authenticationKBA

Security questions about your history, for example, where you lived or what car you financed.

A service might ask which street you lived on five years ago or which lender holds your car loan. The idea is that only the real person would know the answers.

An identity challenge based on information the real person is assumed to know, either a shared secret chosen in advance (such as a security question and its answer) or an out-of-wallet question, meaning one generated from credit bureau or public records rather than from anything in the person's wallet, like a past address or the lender on an old loan.

Knowledge-based challenges show up in two settings:

• Knowledge-based authentication (KBA) checks a returning person at login or account recovery.
• Knowledge-based verification (KBV) checks a new applicant during identity proofing.

The two kinds of questions differ in where the answer comes from:

• Static questions use answers the person set up earlier, such as a first pet or a mother's maiden name.
• Dynamic questions are generated on the spot from records, such as a credit bureau file, and often offer multiple-choice answers.

Knowledge-based authentication sits next to terms that are easy to mix up:

• Authentication is the broader step of confirming a returning person, and KBA is one weak way to do it.
• Multi-factor authentication combines different kinds of proof, while KBA relies only on something the person knows.
• Non-document verification matches supplied details against records, while KBA asks the person questions drawn from them.