You’ve seen them a hundred times. ‘Answer these 10 questions and find out which Disney Princess you are!’ Or ‘Tell us your childhood nickname, your first car, and your dog’s name — and we’ll reveal your spirit animal.’ They’re everywhere, they’re fun, and almost everyone shares them.
Here’s the thing nobody mentions: those questions? They’re the same ones your bank, your email, and every other account uses to verify your identity when you forget your password.
Think about it. ‘What was your first pet’s name?’ ‘What street did you grow up on?’ ‘What’s your mother’s maiden name?’ Those aren’t random quiz questions — they’re often similar to the security questions you’ve already answered on real accounts. Someone who collects your quiz answers now has a really good shot at resetting your password and walking right in.
And you handed it to them voluntarily. Happily. With a laugh-crying emoji.
This isn’t rare. These quizzes can feel totally innocent, and they work because the connection isn’t obvious. Nobody thinks ‘which 90s boy band are you’ is a security threat. But when they ask for your birth month, your hometown, your first car, and your childhood nickname all in one quiz — that’s a profile being built on you.
The University of Illinois Chicago’s cybersecurity guidance specifically flags pet names, hometowns, and birthdays as the kind of personal details you should be careful about posting publicly — because they’re exactly what attackers are looking for.
So what do you actually do about it?
First, treat security questions like passwords — meaning lie on them. Seriously. If your bank asks for your first pet’s name, the answer doesn’t have to be your actual first pet’s name. Make something up. Just make sure you save your fake answer somewhere secure — ideally a password manager app (like Bitwarden or the one built into your phone) or a locked note, not a sticky note or a text to yourself. A hacker who finds out your childhood dog was named Biscuit gets nothing if your security answer is ‘purple telescope.’
Second, before you share a quiz, just do a quick scan of what it’s asking. If it wants specific personal details — names, places, dates — skip it or at least don’t post your answers publicly.
Third, check your privacy settings. If your profile is public, your quiz answers are public to anyone who goes looking.