Your Security Questions Are Answered on Your Facebook

What Was the Name of Your First Pet?

You’ve answered that question a hundred times. Your bank asked when you opened the account. Your payroll site asked. Your domain registrar asked back in 2014. And somewhere along the way, you probably answered it on Facebook too, without even realizing it.

Remember those posts? “Your superhero name is your first pet plus the street you grew up on!” Or “Tag your high school and let’s see who’s still around!” Or the cute photo of Biscuit captioned “Miss my first dog every day.”

Congrats. That’s your password reset.

Why Security Questions Are Broken

Security questions were built on one idea: only you know the answer. Maybe that was true in 1998. Now your mother’s maiden name is on a genealogy site and your high school is on your LinkedIn. The city you were born in sits in your Facebook “About” section. The make of your first car is in a throwback post from 2019.

When the answers aren’t public, they’re often guessable. There are only so many popular pet names, and only so many high schools in Palm Beach County. Researchers have shown for years that a big share of answers can be guessed in a handful of tries, especially for questions like “favorite food.”

Here’s what makes this nasty for business owners. Security questions are often a back door around everything else. You can have a 20-character password and MFA turned on, and some recovery flows will still let someone reset the account by answering two questions. Phone support is the same. A scammer calls your bank or your carrier pretending to be you, nails the verification questions, and they’re in.

Where This Actually Bites

Your bank and payroll provider. Phone support often leans on personal details to verify you.
Your phone carrier. Moving your number to a scammer’s SIM starts with convincing a rep that they’re you.
Old accounts you forgot about. The domain registrar, the old email you use for password resets, the vendor portal from years ago. These are the ones still running on questions you set up a decade ago.
Your employees’ accounts. Anything they use for work that can be recovered with personal trivia.

The Fix: Lie. On Purpose.

This is my favorite security tip because it feels like breaking a rule. Stop answering security questions truthfully.

What was the name of your first pet? Purple Dishwasher 47. What city were you born in? Correct Horse Saddle. The website doesn’t check whether it’s true. It only checks that you give the same answer later. So give it an answer nobody could find or guess.

Two rules make this work:

Use a different fake answer for every site. Same idea as passwords. If one site leaks, that answer shouldn’t open your other accounts.
Store them in your password manager. Most password managers have a notes field or custom fields on each login. Put the question and your fake answer there. You’ll never forget it, and it’s protected by your master password.

Random gibberish works, but a few random words are easier if you ever have to read the answer out loud to someone on the phone. “Taco Lighthouse Seven” is a lot easier to say than “x8#Qp!vL.”

Lock Down the Phone Side Too

A lot of these attacks happen over the phone, so set up the verbal protections most companies offer but don’t advertise:

Your mobile carrier. AT&T, Verizon and T-Mobile all let you set an account PIN or passcode, and they offer some kind of number lock that blocks port-outs. Turn those on. Don’t use your birthday or the last four of your social as the PIN.
Your bank. Ask about a verbal password or extra verification on your business accounts. Many banks will add one if you ask.
Payroll and HR platforms. Find out what their support team uses to verify you, and change anything that’s based on public info.

Clean Up What You’ve Already Shared

You can’t unpost everything, but you can stop adding to the pile:

Skip the “fun” quizzes that ask about pets, streets, first cars or where you met your spouse. Some are just silly. Some are built to harvest answers.
Check your Facebook “About” info and limit who can see your birthday, hometown and family members.
Talk to your team about this. They post the same stuff, and their accounts touch your business too.

Do It This Week

You don’t have to fix every account tonight. Start with the ones that would hurt the most:

Business bank account
Main business email
Phone carrier
Domain registrar
Payroll

Log in to each one, find the security questions in the settings, and replace the real answers with fake ones you save in your password manager. While you’re at it, set up a carrier PIN. That’s maybe an hour, and it closes a door most people forget is even there.

If an account offers a better recovery option, like an authenticator app or a passkey, use it. Security questions are the weakest option on the menu, so only keep them where you have no choice.

Want your team to learn this stuff in a way that sticks? That’s what our security awareness training is for. Reach out through yourtech.solutions.