Knowledge-based authentication (KBA) checks identity with questions only the real customer should know, such as a date of birth or a recent payment amount. It works on any phone and needs only the caller's memory, which is why many contact centers still use it.
It is one method of caller authentication. NIST's identity proofing guidelines use the related term knowledge-based verification (KBV): validating someone's knowledge of personal or private information to verify a claimed identity.
Static and dynamic KBA
Static KBA. The questions use facts on file or answers set up in advance, such as a date of birth or a first pet's name.
Dynamic KBA. The questions are generated during the call from account or credit history, such as the last payment amount or a previous address. The answers are not stored as secrets, so they are harder to collect in advance. Genuine customers also find them harder to remember.
Both forms test something the caller knows. Neither shows that the caller holds a registered phone, card, or app.
Why KBA is considered weak
The answers are often findable. Dates of birth, addresses, and family names turn up on social media, in data breaches, and through social engineering. A caller who knows the facts passes, whoever they are.
NIST excludes it from key uses. NIST's SP 800-63A-4 (2025) states that knowledge-based verification or authentication shall not be used for identity verification. It still allows KBV inside a fraud management program. SP 800-63B-4 bars prompting users for KBA or security questions when they choose passwords. The guidelines are written for US government online services.
Bank regulators expect more. In August 2021, the US Federal Financial Institutions Examination Council issued authentication guidance for banks. It says reliable verification methods generally do not depend solely on knowledge-based questions. It also warns that threat actors have often used social engineering to trick call center staff into resetting credentials.
Genuine customers fail too. Dynamic questions about old addresses or past payments can stump the real account holder. Each failure means a transfer, a callback, or a locked account.
KBA in a contact center today
One factor among several. For a balance question, KBA plus a match on the calling number may be enough. A change of payout account or contact details usually calls for a second factor.
Something the caller holds. The FFIEC guidance lists stronger options for credential resets. They include a one-time code to a registered device, an authenticator app, a callback to a number on file, and secure video. In the EU, PSD2 defines strong customer authentication as two or more independent elements from knowledge, possession, and inherence.
No hints. An agent who says "Is it the one in May?" gives a fraudster part of the answer. Fixed questions, asked the same way on every call, leak less.
Attempts counted per account. A limit on failed answers works best when it counts across calls and channels, so a caller cannot reset the count by ringing back.
Frequently asked questions
What is an example of knowledge-based authentication?
A contact center asks the caller for their date of birth and the amount of their last bill, then compares the answers with the account. A security question, such as the name of a first school, is another example.
What is the difference between static and dynamic KBA?
Static KBA uses facts stored in advance, such as a date of birth or a security answer. Dynamic KBA builds questions at the time of the check from account or credit history. Dynamic questions are harder for an attacker to prepare for, and harder for some customers to answer.
Is knowledge-based authentication still allowed?
Generally yes for private companies, within their regulators' rules. NIST's 2025 guidelines, written for US government online services, bar it from identity verification. US bank regulators expect it not to be the only check, and EU payment rules require two independent elements for strong customer authentication.
Can an AI voice agent run knowledge-based authentication?
Yes. An AI agent can ask the questions, check the answers against back-end systems, and count failed attempts. The pass or fail decision is best taken by fixed rules, with a handover to a person when checks fail. PII redaction keeps the answers out of transcripts and logs.
How we approach this at Zowie
At Zowie, the language model holds the conversation. A separate, deterministic Decision Engine returns every amount, rate, offer, disclosure, and escalation from your rules. What the agent may disclose follows that policy on every call. Every decision is written to an audit log. You are welcome to book a demo.
Explore: Caller authentication, AI identity verification, PII redaction, AI agent security, AI audit trail, Customer service in banking