We have an application where a user is required upon registration to set up three security questions and answers

When they login to the application, they must answer one of the questions after entering their username and password. Should they forget their password, 2 of the security questions are presented to be answered along with 2 items of data for them to enter (DOB, NI Number etc etc)

There was recently a scenario whereby a user forgot the answers to their security questions(!) and we had to re-register them from scratch which was quite cumbersome.

What is the correct UX for the scenario when a user forgets the answers to their security questions?

  • Hold on just one second. You are saying that upon successfully logging in to your app/website, you are always forcing the user to answer one of their security questions? – MonkeyZeus Dec 16 '15 at 17:05
  • @MonkeyZeus - yes. Client's requirement/insistence! – Mike Dec 17 '15 at 11:53
  • What type of app is this? Government, military, banking? I highly suggest talking with the client to figure out the root reason for asking a security question upon every single successful login. I would even go as far as saying that this "feature" is actually making your client's business look bad because, to me, this screams "our website and/or userbase is inept!". – MonkeyZeus Dec 17 '15 at 13:59
  • 1
    @MonkeyZeus - could you possibly expand on why this screams "inept" please? – Mike Dec 17 '15 at 14:14
  • 1
    From a website perspective: Please enter your username and password, you've entered it correctly but we don't trust you, just to make sure that this was not a fluke, please answer a security question. From a userbase perspective: We are having issues with users that cannot control their login credentials so they've blamed us when their account was compromised; our attempt to mitigate this is to add an additional step to the login process. I would be interested to know why your client is insisting this "feature". – MonkeyZeus Dec 17 '15 at 14:46

The correct UX approach is to disregard the long overdue pattern of so called “security questions”. Users tend to forget them as well, especially in terms of capitalization of answers.

Instead you should provide a “forgotten password” link which sends a one-time link to the registered e-mail account where the user can provide new credentials.

enter image description here

  • 1
    This answer does not answer OP's question. – MonkeyZeus Dec 17 '15 at 13:48

What is the correct UX for the scenario when a user forgets the answers to their security questions?

For your authentication mechanism (which, unless it's required by law, I see as paranoid) security question is equivalent and complementary to password.


download bmml source – Wireframes created with Balsamiq Mockups

In this case you may rephrase your question to "What is correct scenario when an user forget her password?".

Provide a password reset feature (see also What are great examples of a "forgot password" UX/UI pattern?), you do not need to re-register them, simply send then an e-mail with a link they can follow to insert a new password and three new security questions. Just remember that:

  • Link must be temporary and can be used only once.
  • Do not pre-fill new security questions with previous values.
  • Consider to require them to also enter user name and/or some other code you're sure they already have.

I have forgotten my security questions on occasion or found that the website offered me questions which I hadn't selected (so I couldn't answer) so effectively the same as forgetting!

I thought to myself "Uh oh! What happens now?"

The website in question asked me to authenticate myself in a number of ways if I remember correctly and eventually reset my security questions as part of this process, probably due to my not knowing/remembering the answers at least I would hope that it's because I didn't know the answers as it would be very irritating to reset security questions if a user only forgot their password!

I cannot remember the exact authentication steps that got me back to safety but from the top of my head.

My UX scenario "likes" would be:

  1. An email "round trip" - "We have sent...check your email...click on the link..." etc
  2. Once they follow the link back I would offer, no force them to select new security questions...
  3. ...and possibly email the selected questions (but not the answers obviously) back to them so they could refer to them later if needed.
  4. after (if) this was implemented a reminder prompt could inform the user to check their "selected security questions" email sent to them on such and such a date!

Points 3 and 4 might be overkill though!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.