Security Questions and How to Answer Them Safely

You set a strong, unique password, then the site asks for your mother's maiden name and the name of your first school. Those security questions can quietly undo all that effort, because the answers are often easier to find than the password itself. A stranger with twenty minutes, a social media profile and a public records site can sometimes guess them.

The fix is not complicated, and you do not need to stop using accounts that require them. You just need to stop answering them truthfully.

Why security questions are a weak link

Security questions were designed as a backup for people who forget their password. The problem is that they rely on facts about your life, and facts about your life are rarely secret.

They are researchable. Your birthplace, your high school and your first car often appear on social profiles, in old posts, in obituaries or in leaked data.
They are guessable. "Favourite colour" has a handful of common answers. "Favourite food" is not much better. Studies of real accounts have found that a large share of answers to common questions can be guessed within ten attempts.
They never change. You can rotate a password. You cannot rotate where you were born. Once the answer leaks in one breach, it works on every site that asks the same question.
They are often shared. Family members, old friends and former partners already know most of the answers.

Attackers who target a specific person, for example in an account takeover or a hacked email account case, often go after the recovery path rather than the password. A weak security answer is exactly that kind of side door.

How to answer security questions safely

The safest approach is to treat every security answer as a second password: random, unique and stored somewhere safe.

Step 1: generate a random answer

Use your password manager's generator to create a random phrase for each question. Something like "copper lantern fifteen orchard" is good: it is long, it has nothing to do with you, and it can be read aloud to a phone support agent if needed. Avoid strings of symbols here, because some sites reject them and they are hard to say over the phone.

Step 2: use a different answer for every site

If your fake "first pet" is the same on your bank and your shopping account, a breach of the shop exposes the bank. The same logic behind giving every online account a different password applies to security answers.

Step 3: store the question and answer together

Most password managers let you add custom fields or notes to an entry. Save each question with its answer, exactly as you typed it, including capital letters and spaces. Label it clearly, for example "Security Q: city of birth".

Step 4: update the accounts that matter most

You do not need to fix every account tonight. Start with the five that would hurt most if someone got in:

Your main email account
Your bank and any payment apps
Your mobile carrier account
Your Apple, Google or Microsoft account
Any account that stores your ID documents, such as a tax or government portal

Each one takes about five minutes. That is under half an hour for the accounts attackers want most.

A quick comparison of answer styles

Answer style	Example	Risk
True answer	"Leeds"	High: often public or guessable
Slightly altered truth	"Leeds1985"	High: easy to guess once the base is known
Same fake answer everywhere	"Bluebird"	Medium: one breach exposes all sites
Random unique phrase, stored	"copper lantern fifteen orchard"	Low

The "memorable lie" advice is only half right

A popular tip is to give a false answer you will remember, such as always saying your first pet was called "Batman". It is better than the truth, but I would not recommend it as your main method, for two reasons.

First, people tend to reuse the same memorable lie on every site, which turns it into one shared secret. Second, memorable lies are often still guessable by people who know you, because they reflect your humour and interests. A friend who knows you love superhero films will try "Batman" sooner than you think.

A random answer you never have to remember, kept in a password manager, avoids both problems. If you are not using a password manager yet, our explanation of why a password manager is the single best security upgrade makes the case in plain terms. If you truly must remember an answer, for example for a phone support check, make it a long, unrelated phrase and write it on the same printed sheet as your recovery codes.

Better options than security questions

Where a site offers alternatives, use them. Security questions are now a legacy feature, and many larger services have dropped them entirely in favour of stronger recovery methods.

Two factor authentication with an authenticator app or hardware key protects the login itself.
Recovery codes, printed and stored safely, let you get back in without answering anything about your life.
A trusted recovery contact, offered by some providers, lets a person you choose confirm your identity.
Passkeys replace the password and are tied to your device, which removes much of the reason for questions at all.

If an account offers both security questions and one of these options, set up the stronger option and give the questions random answers anyway.

What to do if you have used real answers for years

Do not panic. Change the answers on your most important accounts this week, starting with email. Check whether the same questions appear on your bank and mobile carrier accounts, and change those too. Then make a habit of setting random answers whenever a new account asks. Within a few months, most of your important accounts will have been updated without any extra effort.

It is also worth one quick search of your own name. Look at what a stranger can see on your public profiles: a tagged school, a hometown in your bio, a birthday post with your age. Removing or hiding three or four of those details takes about fifteen minutes and makes any remaining real answers much harder to research. Phone support teams at banks and carriers may still ask spoken questions, so ask them to note a verbal password on your account as well.

Frequently asked questions

Should I give false answers to security questions?

Yes, as long as you store them safely. Real answers can often be found online or guessed by people who know you. A random, unique answer saved in a password manager is much harder for anyone to discover.

Can hackers find the answers to security questions?

Often they can. Details like your birthplace, school and pet names appear on social media, in public records and in old data breaches. Targeted attackers regularly combine these sources to reset accounts through the recovery process.

Where should I store my security question answers?

The best place is your password manager, in the notes or custom fields of the matching account. Save the exact question and answer together. Some people also keep a printed copy with their recovery codes in a safe place at home.