Why does my bank bother asking basic personal questions to log in to online banking?

Question

To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from a code-generator device.

To me it seems that 99% if not all of the security comes from the one-time code-generator. The personal question is so basic and easy for someone to find out that it seems to add nothing to the process.

What makes me curious is that it almost seems intentionally basic and easy. The bank could have asked me to create a more secure password, but they didn't.

My guess is that they wanted to add two factors, but didn't want to confuse users with a requirement for a secure password as well as the code-generator device.

Is there a good reason for them to require a basic and insecure question instead?

Answer 1

I agree that this is bad practice. You can make it better practice by scrambling the answers in one of many ways -- making questions about your father refer to your first car and vice versa, and so on, or giving false answers, or given IRRELEVANT answers (if you can remember what your irrelevant answers were), would discourage/prevent social engineering attacks. There's nothing in their system which requires that you answer these honestly, just consistently.

Some systems will let you enter your own questions, which is a huge improvement since it encourages picking things that act as more-secure passwords.

However... I've only seen these used to secure one specific operation, that being password reset, which is additionally handshaked (handshook? checked, anyway) by interaction with the account owner's mailbox. Of course the mailbox may also have been cracked, but arguably this is a case of two less-secure mechanisms adding up to one that's almost tolerable.

It's still worth complaining to your bank, though. If enough people complain, they may improve it.