• Success Criterion 3.3.8
  • Conformance level AA

Security Question Requiring an Exact Memorized Answer

3.3.8 — Accessible Authentication (Minimum)

Scenario

Setting

A ride-hailing app's trip booking screen

What’s wrong

Security questions demanding recalled exact strings as the only second factor with no alternative (memorization test).

Example 

<!-- triggered when booking from a device the app doesn't recognize -->
<label for="security-answer">What was the name of your first pet?</label>
<input id="security-answer">
<!-- the only second factor before booking a trip; one mismatched character and access is denied -->

Why it matters

A rider booking a trip from a new device gets challenged with the exact-recall security question they set up months ago, and typing 'Fluffy' instead of 'Fluffy the Cat' locks them out of booking entirely.

How to test

Check whether a security question demanding an exact recalled answer is the only second factor: if there's no non-memory-based alternative, it fails.

How to fix

Replace exact-recall security questions with a one-time code or biometric option that doesn't test memory at all.

<!-- security question replaced with a non-cognitive second factor -->
<label for="otp">Enter the 6-digit code sent to your phone</label>
<input id="otp" autocomplete="one-time-code">

Outcome

The rider verifies with a text code instead of a remembered phrase and books the trip without delay.

Who is affected

People with memory-related cognitive disabilities who cannot reliably recall the exact wording of an answer given months earlier.

Learn more

Related scenarios