Why you should not answer your security questions truthfully

TOCA · KNOWLEDGE

By TOCA Editorial · 2026 · 5 min read

Your mother's maiden name. The name of your first pet. The city you were born in. These questions are meant to protect your accounts. In practice, the answers are often among the first things anyone can find out about you.

This article is the first part of our series on digital habits that take little effort and make a real difference. It covers three things: security questions, where you keep your passwords, and accounts you never really needed.

The problem with security questions

Security questions were introduced so you could reset a forgotten password. The idea was simple: only you know the answer. That may once have been true. Today, birthplaces, schools, pets and family names are often visible on social media or on old club and community pages. Sometimes a casual conversation is all it takes to learn them.

On top of that, many answers are simply predictable. A 2015 study by Google found that typical security answers can often be guessed in just a few attempts. At the same time, a significant share of users could no longer remember their own answers later on. A security question is often neither secure nor reliable.

The real risk lies in what the question does. Anyone who can answer it can, in many cases, reset your password. A strong password is of little use if there is an open back door right next to it.

"A security question is only as secret as the answer that is already somewhere online."

The better answer is a false answer

The solution is simple: do not answer security questions truthfully. Use a random combination of words that has no connection to your life. Asked for the name of your first pet, you might answer "Copper Roof Nineteen Eastwind".

The second step is the one that matters. Store that answer in the same place as the password it belongs to, ideally in a password manager. A random answer you have forgotten locks you out just as effectively as a forgotten password.

One practical note: some banks and mobile carriers ask for the answer over the phone. In that case, choose a combination of ordinary words that is easy to say out loud, rather than a string of special characters.

"The safest answer to the question about your first pet has nothing to do with your pet."

Where passwords do not belong

The notes app on your phone, a spreadsheet called "Passwords" on your desktop, a slip of paper under the keyboard, an email to yourself: all of these are convenient. As a rule, though, none of them has any extra protection. Anyone who gains access to the device or the cloud account can read everything.

Reusing the same password is just as risky. When a single service is breached, attackers automatically try the stolen login details on hundreds of other services. A data leak at a small online shop can end up giving someone access to your email inbox.

A password manager solves both problems. It stores your login details in encrypted form, creates a long, unique password for every account, and leaves you with only one master password to remember. Germany's Federal Office for Information Security (BSI) also recommends using a password manager.

The password managers built into browsers and operating systems are much better today than their reputation suggests, and for many people they are a sensible place to start. A dedicated password manager is worth it mainly if you use devices from different manufacturers, or if you want to keep security answers and other sensitive notes alongside your passwords.

Wherever it is offered, also turn on two-factor authentication. Then a stolen password on its own is no longer enough.

Every account is an open door

A discount code in exchange for signing up, a customer account for a single order, a free trial that was never cancelled. Over time, dozens of accounts pile up that you barely remember.

Each of these accounts stores data about you: your name, your email address, often your home address and payment details too. Every company holding that data can become the target of an attack. Old accounts still protected by a password from ten years ago are especially vulnerable.

You can check for free whether your email address has appeared in known data breaches, for example with Have I Been Pwned or the Identity Leak Checker from the Hasso Plattner Institute. If you are only ordering once, choose guest checkout. Accounts you no longer use are best deleted. In the EU, Article 17 of the GDPR gives you the right to request the deletion of your personal data.

"The safest account is the one that was never created."

A good start for this week

You do not need to do everything in one day. One afternoon is enough for the most important steps.

Start with your email account. Your inbox can be used to reset the passwords of almost every other account. It deserves your strongest password and two-factor authentication.

Replace your security answers. Begin with email, banking and your Apple or Google account. Enter random answers and save them in your password manager.

Replace reused passwords. Most password managers show you which passwords are reused or have appeared in data breaches.

Delete one old account. Just one. Once you start, you usually keep going.

The next part of the series looks at what you reveal about yourself, often without noticing.

Digital self-determination does not end at the screen. Passports and bank cards can also be read contactlessly. The TOCA Passport Shield and the RFID Safe Wallet protect them against unauthorised reading via RFID and NFC. DEKRA tested. Designed in Germany. Built for everyday use. Find out more.