Knowledge-Based
Authentication

Knowledge-based authentication (KBA) is an identity verification method that empowers you to verify a customer’s identity using highly personalized “out of wallet” questions.

What is KBA?

Knowledge-based authentication, or “KBA,” is an identity verification method in which users are asked one or more personalized questions that are known only to them. KBA is a form of “out-of-wallet” authentication that is often used to lend additional surety to IDV processes that leverage other methods of verification such as identity data or documents.

Types of KBA: Static vs. Dynamic

There are two common types of KBA: static and dynamic. Veratad only uses dynamically-generated questions augmented by machine learning and AI to create highly secure KBA workflows.

STATIC KBA

Static KBA employs questions based on personal information regarding static details such as addresses or phone numbers, with users required to provide correct answers during the authentication process. However, static KBA’s effectiveness has diminished due to security vulnerabilities such as data breaches and the ease with which bad actors can obtain a user’s answers to static KBA questions. 

DYNAMIC KBA

To address the limitations of static KBA, Veratad leverages dynamic KBA which incorporates context-specific questions that are harder for fraudsters to figure out. Dynamic KBA questions are AI-generated from public and private records collected using the signer’s social security number. They may range from demographic questions to questions related to credit transactions.

Which Businesses Need KBA Most?

Knowledge-Based Authentication (KBA) is commonly used by businesses in industries that require a high level of identity verification and security measures in place. Here are a few examples.

Is KBA Dead?
Multi-layered KBA Verification Strategies

While KBA has faced criticisms and limitations in recent years, it is not accurate to say that knowledge-based authentication is dead or that businesses no longer have use for it. In fact, when employed as part of a multi-layered age and identity verification strategy, KBA can add tremendous value, enhancing assurance and security. 

KBA & Customer Experience

KBA questions offer an ideal way to reduce friction in processes that can sometimes frustrate customers, such as those associated with onboarding, transactions, and account login. This is primarily because KBA allows users to cycle complete verification steps without needing to reach into their wallet to produce specific documents. This is also what makes KBA easy to deploy as an additional escalation layer when further identity assurance is needed.

What Is the Implementation Process for KBA?

Implementing a KBA solution can be complicated without an experienced identity verification provider to help you integrate and deploy it effectively. That said, a typical implementation will include the following steps.

Use Case

A business identifies its specific use case for KBA and determines where it will be integrated, such as during user onboarding or transactional processes.

Vendor Selection

Next, they select a reliable KBA provider that offers a robust set of questions and answers based on relevant personal information.

Solution Integration

The KBA solution is then integrated, often via an API, into the business’s existing system or application.

Configuration

During the integration, businesses configure their desired KBA settings, including the types of questions to be asked and the level of security required.

Testing

The KBA solution is tested and validated to ensure accuracy and effectiveness.

Optimization

Businesses monitor and review the KBA implementation to adapt to changing security needs and potential vulnerabilities, ensuring ongoing protection against fraud and unauthorized access.

KBA Alternatives

Every business is unique and sometimes KBA isn’t the most appropriate method for a given verification need. There are several alternatives to KBA that can offer enhanced security and help mitigate some of the limitations associated with KBA, particularly the static variety. Here are a few examples.

KBA Verification Questions

Effective KBA questions provide an added layer of security, especially when combined with data verification, possession-based document verification, or multi-factor authentication. Our dynamic, out-of-wallet challenge questions are non-intrusive and easily deployed when you need an enhanced authentication solution. 

  • What was the street name of your childhood home?
  • In which city were you born?
  • What is your mother’s maiden name?
  • What is the name of your favorite teacher?
  • Which high school did you attend?
  • What was the make and model of your first car?

  • What is the middle name of your oldest sibling?
  • What is your favorite book/movie/song?
  • What is the name of the street you lived on in your last residence?
  • Which year did you graduate from high school?

  • What was the street name of your childhood home?
  • In which city were you born?
  • What is your mother’s maiden name?
  • What is the name of your favorite teacher?
  • Which high school did you attend?
  • What was the make and model of your first car?
  • What is the middle name of your oldest sibling?
  • What is your favorite book/movie/song?
  • What is the name of the street you lived on in your last residence?
  • Which year did you graduate from high school?

What Does KBA Cost?

The cost of a KBA solution can vary depending on several factors, including the verification provider, the level of customization and integration required, the volume of transactions, and the specific features and capabilities of the KBA age or identity solution. Pricing models for KBA solutions can differ, such as per transaction, tiered pricing based on usage levels, or subscription-based models. It is recommended for businesses to reach out to KBA providers directly to discuss their specific needs and obtain accurate pricing information tailored to their requirements.

Age Verification: Frequently Asked Questions

While there has been a shift in the popularity of KBA, it is still regarded as a secure form of ID verification if the personal information used is secure and the connected databases are also properly safeguarded.

Knowledge-based authentication challenge questions come from data associated with an individual. This can be from a credit bureau, a DMV or government entity, a mobile carrier or another secure source. Reputable KBA providers never share data or results with non-authorized individuals.

KBA is used as all or part of an identity verification workflow for user onboarding, a purchase, or another event that requires certainty that an individual is who they say they are. KBA is often used upon escalation after another verification method returns an unclear or negative response, or to provide an additional layer or surety and security.

As is the case for all Veratad’s data verification services, upon completion of a KBA verification transaction, Veratad only stores a “footprint” of each transaction for audit, reporting and compliance purposes. This means that Veratad does not store any sensitive personal information associated with a knowledge-based authentication transaction.

KBA is among the most common identity verification methods deployed by leading companies. It is an effective way to gain or add certainty that an individual is who they say they are, as it relies upon knowledge that only one or a few people would have.

Like any verification method, KBA can add friction to an onboarding or purchase process. When properly deployed, however, KBA represents only a few seconds of a user’s time.

Secure Online Identity Proofing

Let Veratad show you what rapid, flexible and integrated identity verification can do for your business.