Helpfully, NIST just recently deprecated knowledge-based authentication (security questions) so we should be seeing less of this as time goes on.