You use security questions effectively as a second factor.
Two-Factor Authentication
Two-Factor authentication (2FA) is used to make it harder for attackers to get the credentials to login. You might have seen them in big services like Amazon Two-Step Verification or Google. It absolutely makes sense to use them if money is involved.
Please read the Multi-factor authentication wikipedia article for more details.
Security questions for 2FA
Better suited in another context, see 2-Factor Authentication vs Security Questions
Security questions for "forgot password"
Security questions make sense to avoid that your users get trolled by others through the "forgot password" function. Here is a small user story how that works:
Anna is on GitHub. Her username is her e-mail address, which she also uses to sign her commits and which she also has publicly in her profile.
Anna picks up a fight with Bob. Bob knows that Anna is on Github and wants to annoy her. So he triggers the "forgot password" function of GitHub every hour to distract Anna.
Let's say GitHub allowed Anna to set a security question (if she wants). Then the story would look like this:
Anna is on GitHub. Her username is her e-mail address, which she also uses to sign her commits and which she also has publicly in her profile. As she got some 'forgot password' emails before, she sets her security question to "What is the second name of the mother of my spouse?". A couple of people in her family know this, but it is not public information.
Bob knows that Anna is on Github and wants to annoy her. So he triggers the "forgot password" function. He gets asked "What is the second name of the mother of my spouse?". He googles for it, but cannot find this information. Anna is not bothered.
See also
Please enter your username and password, you've entered it correctly but we don't trust you, just to make sure that this was not a fluke, please answer a security question.
From a userbase perspective:We are having issues with users that cannot control their login credentials so they've blamed us when their account was compromised; our attempt to mitigate this is to add an additional step to the login process.
I would be interested to know why your client is insisting this "feature".