Security Questions Done Right

treat answers like passwords, not like facts

The security question map

Security answers are keys, and the answers that fail are public records. The answers that work are memorable, unguessable, and known to the family member who may need them in an emergency.

1. The answers that failPublic records and posted factsMother's maiden name, city of birth, high school, pet names, street names, and anniversary dates are public record, findable online, or already posted on social media. And an answer the parent cannot remember locks the family out.
2. The answers that workFake, family-known, written downA consistent made-up answer (the same fictional food for every "favorite food" question) is not findable anywhere; make it a shared family phrase the sibling or adult child knows; and write it in the family password vault next to the password.
3. Prefer 2FAWhere the account offers it, use itTwo-factor is stronger than any security question. The parent-friendly 2FA setup covers the choices; questions remain only where 2FA is not offered.
4. The emergency caseHospital or passing: the family must get inWhen the parent cannot answer, a sibling or the executor answers the questions. A made-up family phrase stored in the vault gets the family in; a fact only the parent knew can make the account unrecoverable, which is why the recovery limits matter.

Send this Print this

The answers that fail

• Mother's maiden name, city of birth, high school. These are public record or easy to find online. The FTC's identity-theft guidance lists the personal details scammers collect to impersonate someone.
• Anything the parent already posted. Pet names, street names, and anniversary dates appear on social media and in family trees.
• Answers the parent cannot remember. A security question is useless if it locks the family out; the recovery guide shows how often that is the actual failure.

The answers that work

1. Use a fake answer that is easy to recall. A consistent made-up answer (for example, the same fictional food for every "favorite food" question) works across accounts and is not findable anywhere.
2. Make it a family-known phrase. The family needs to answer it in an emergency, so the answer should be something the sibling or adult child knows, like a shared joke or a fixed family phrase.
3. Write it down in the vault. The answer belongs in the family password vault next to the password, so nobody has to guess under pressure.
4. Prefer two-factor over questions. Where the account offers 2FA, use it instead; the 2FA setup guide covers the parent-friendly options.

The emergency case

When the parent is in the hospital or has passed, security questions are what a sibling or the executor must answer to unlock an account. If the answer is a made-up family phrase stored in the vault, the family gets in. If it is a fact only the parent knew, the account may be unrecoverable, which is why the recovery limits matter.

Related guides

• The family password vault
• Recovery codes: the paper backup
• Account recovery: getting back in

Sources & verification

This page is checked against the standards in our editorial policy, preferring government sources for security guidance. Reviewed August 2026:

• FTC: What To Know About Identity Theft (retrieved August 2026)
• CISA: Secure Our World (retrieved August 2026)

Found an error? Report it: we log and correct material mistakes publicly.

Quick answers

Common questions, answered plainly. The details match the sources above.

Should the parent answer security questions truthfully?

Not necessarily. Real facts like a maiden name or birth city are public record or easy to find. A consistent made-up answer that is memorable and stored in the family vault protects the account and still lets the family in.

What if the parent already forgot the answers?

Use the account's recovery options (recovery email, phone, or codes) before relying on questions. Where 2FA is available, turn it on so questions rarely matter at all.

Found an error? Report it.