Why knowledge-based authentication is inadequate and what to do instead

On October 5, 2026, the Danish government announced that unauthorized parties had accessed data on about 8.8 million people in the Central Person Register (CPR), Denmark’s national civil register. The data includes the names, addresses and CPR numbers of residents, people living abroad and people who have died. The attack exploited a company’s lawful access to the register. Police are investigating.

This breach reinforces existing advice: organizations should not rely on personal data to authenticate users.

The problem: knowing personal data is not proof of identity

Many services still ask people to confirm personal information, such as addresses, ID numbers or dates of birth, to prove who they are. This is known as knowledge-based authentication. But the level of assurance is low, since it only shows that someone knows the data, not that they are the person they claim to be.

Personal data is not suitable for user authentication: it is often readily available through social media, data breaches or simply guessing. And unlike a password, it cannot easily be changed once it is exposed.

This breach shows that even personal data that was not previously publicly available can be exposed at any time. Such breaches are a long-standing, global issue. National ID information and other personal data have been exposed in other countries before, including in Turkey in 2016 and in several incidents in India where Aadhaar numbers leaked from third-party systems that held copies of them.

Adding more knowledge checks may help in the short term, but that data may leak in the next breach. Besides, it is hard to verify that data used for the additional knowledge checks has not already been leaked.

Security guidance reflects this. For example, NIST SP 800-63-4 says that knowledge-based authentication “does not constitute an acceptable secret for digital authentication.”

Replacing knowledge-based authentication

In the wake of the breach, the Danish Resilience Agency has published new guidance stating that knowledge-based authentication using the leaked data should not be considered sufficient in high-risk cases such as account recovery. 

The agency’s leading recommendation is to use strong authentication based on the national electronic ID.

Many organizations already use strong authentication, such as an authenticator app or a national electronic ID, when users log in online. OpenID Connect is the widely used standard for integrating with identity providers that offer these authentication methods. But knowledge-based authentication is still often used where strong authentication is more difficult to implement, such as during phone calls. Attackers will target the weakest link in an organization’s security model, and when personal data is leaked, that link is often the phone line or the account recovery process.

Strong authentication across devices with CIBA

Authenticating users on the same device that is granted access remains the most secure option. That is not possible during a phone call, but strong authentication can still be done in these “decoupled” flows where the user confirms on another device. For example, a customer support agent can send a request directly to the caller’s electronic ID app during a phone call. OpenID Connect Client-Initiated Backchannel Authentication (CIBA) is a standard created to achieve this.

Decoupled flows require additional care to prevent phishing and man-in-the-middle attacks. In particular, organizations should implement channel binding, which ties the authentication to the specific call to make attacks difficult. One way to do this is for the user’s authentication app to show a random code that the user reads out to the agent, who checks that it matches the code in the request sent by their own system before proceeding.

The benefits of choosing open standards

Building on open standards makes strong authentication easier to implement and maintain. OpenID Connect enables same-device authentication, and OpenID Connect Client-Initiated Backchannel Authentication enables decoupled flows. Because these standards are widely supported, organizations adopting them can work with and move between vendors without starting from scratch. Organizations with high security requirements, such as financial institutions, may prefer to use vendors that are OpenID Certified against the security-oriented FAPI-CIBA conformance profiles. Certification uses a thorough test suite to validate compliance with the standards.

Time to move on from personal data checks

The recent breach is not the first time personal data has been leaked, and it won’t be the last.

Frederik Krogsdal Jacobsen, co-chair of the OpenID Foundation’s AB/Connect Working Group, said: “We have long known that knowledge-based authentication is not secure. This breach is a reminder to anyone still relying on it that they are exposing themselves and their customers to serious risk. Fortunately, better solutions are available, and choosing technology based on OpenID standards makes it straightforward to integrate with a wide range of vendors.”

Bjorn Hjelm, co-chair of the OpenID Foundation’s MODRNA Working Group, which created the CIBA specification, said: “CIBA was precisely created to take care of such cases. Using it, organizations can improve their security posture and protect their customers better.”

Organizations relying on personal data to authenticate Danish users must quickly find alternatives. For everyone else, knowledge-based authentication is a security incident waiting to happen. The time to move to strong authentication is now.

About the OpenID Foundation

The OpenID Foundation (OIDF) is a global open standards body committed to building trusted identity ecosystems. Our mission is to lead the global community in identity standards that are secure, interoperable, and privacy respecting. Founded in 2007, we are a community of technical experts. The Foundation's OpenID Connect standard is now used by billions of people across millions of applications. More recently, the FAPI security profile - built on OAuth 2.0 - has become the standard of choice for interoperable Open Banking and Open Data implementations, while OpenID for Verifiable Credentials specifications are underpinning a new generation of digital wallets. Today, the OpenID Foundation's standards are the connective tissue that enable people to assert their identity and access their data at scale, the scale of the internet, enabling "networks of networks" to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.