One european bank I have account at uses security question, but it seems to be only used as additional layer of authentication when you make changes to your account settings (in person) and not for anything online.