Topic starter
22/06/2026 5:02 pm
TL;DR: Knowledge-based authentication fails under modern threat models because answers are static, learnable, and replayable, while breaches, OSINT, and coached social engineering make them easy to obtain, according to Scramble ID. Replacing KBA means replacing human judgment with session-bound cryptographic proof, because the old trust model assumes a secret still exists when attackers have already learned it.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “KBA Is Dead: A Contact Center Playbook for Replacing Security Questions”.
Key questions
Q: What breaks when KBA is removed from contact-centre recovery flows?
A: The main failure is not verification inconvenience, but the loss of a long-standing bypass that attackers can learn and replay.
Q: Why do security questions create account takeover risk?
A: Because attackers rarely need to break them cryptographically.
Q: How can organisations tell whether KBA replacement is working?
A: Look for a drop in successful social-engineering attempts, fewer agent overrides, and measurable use of the new cryptographic path without fallback to old questions.
Practitioner guidance
- Inventory every KBA touchpoint Map all workflows that still ask security questions, including account recovery, device recovery, payout changes, contact detail updates, SIM swaps, and high-value transfers.
- Replace spoken secrets with device-bound proof Use a live challenge that is confirmed in a trusted app on a registered device and tied to the current session, so agents rely on cryptographic confirmation rather than answer matching.
- Remove silent fallback paths Eliminate any process that allows staff to revert to old questions, accept caller urgency as a reason to bypass verification, or reset access after a failed challenge without independent approval.
Bottom line: KBA fails because the answers behind security questions are now reachable by attackers before the call, which turns support verification into a research exercise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 5:16 pm
KBA is a governance failure because it outsources identity assurance to information that attackers can now acquire before the call. The model assumes that a caller can be distinguished by private knowledge, but breach ecosystems and OSINT have collapsed that assumption. In practice, the problem is not only weak questions, but a verification design that is already downstream of attacker research. Practitioners should treat KBA retirement as a trust-model correction, not a channel-specific tweak.
A question worth separating out:
Q: Should contact centres keep any fallback after KBA is retired?
A: Yes, but only if the fallback is slower, independently approved, and auditable enough that attackers cannot use it as the new fast path. A fallback that can complete the same call, with the same agent, and the same urgency as the primary route will eventually become the preferred bypass. Recovery must add friction, not remove it.
👉 Read our full editorial: KBA replacement in contact centers now requires cryptographic proof