Knowledge-based authentication
Knowledge-based authentication uses answers about a person's history or personal details to help establish identity, commonly through security questions.
Personal facts are not account secrets
Knowledge-based authentication, or KBA, asks questions such as where someone went to school or previously lived. Other people may be able to find those answers. Mandiant documented UNC3944 using personal information to impersonate users in help-desk interactions.
A password is also a knowledge factor, but it is meant to be an authentication secret. An employee number can help an agent locate an account without proving who is calling.
Where NIST draws the line
NIST SP 800-63A-4 prohibits knowledge-based verification or authentication for the identity-verification step in its proofing requirements. SP 800-63B-4 separately prohibits prompting subscribers to use KBA or security questions when choosing passwords.
If a caller knows an employee’s manager and office location, the help desk has matched facts to an account. It has not checked control of an approved authenticator. If those answers are enough to approve an MFA reset, the process needs stronger verification, not more discoverable questions.