To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from a code-generator device.
To me it seems that 99% if not all of the security comes from the one-time code-generator. The personal question is so basic and easy for someone to find out that it seems to add nothing to the process.
What makes me curious is that it almost seems intentionally basic and easy. The bank could have asked me to create a more secure password, but they didn't.
My guess is that they wanted to add two factors, but didn't want to confuse users with a requirement for a secure password as well as the code-generator device.
Is there a good reason for them to require a basic and insecure question instead?