What is a Knowledge‑based approach?
A knowledge‑based approach requires something a user knows to validate identity or clear risk checks—static passwords, PINs, security questions, out‑of‑wallet quiz data. Easy to deploy, easy to leak. Breaches, social media have made many “secret” facts public trivia.
Where it still fits: low‑stakes flows with backup purpose, or layered behind better factors. Never alone for recovery, payouts, or new payees. Replace brittle questions with device binding, resistant MFA; when assurance must jump, request a selfie with liveness inside a broader identity verification step.
