Technique
technique:instant_knowledge_based_authentication
Also: KBA, instant KBA
Authentication method that asks questions based on personal and credit-record data already held by the service.
Authentication method that asks questions based on personal and credit-record data already held by the service.
“They use something called instant KBA, or knowledge-based authentication.”
“This is a series of questions they ask that only you would know the answer to”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Internal Revenue Service | Explicit | 26 |
| incoming | ASSOCIATED_WITH | National Institute of Standards and Technology | Attributed | 26 |
| incoming | INVOLVES | IRS Get Transcript breach | Explicit | 26 |
Internal Revenue Service USES Instant knowledge-based authentication
The IRS used instant knowledge-based authentication to verify users of Get Transcript.
Explicit Confidence 99% · Jack Rhysider EP 26 Details
“The irs.gov website is different. They use something called instant KBA, or knowledge-based authentication.”
National Institute of Standards and Technology ASSOCIATED_WITH Instant knowledge-based authentication
NIST specifically commented on the privacy risks of instant KBA, stating that involuntary exposure is inappropriate unless the risk is nearly zero.
Attributed Confidence 98% · Jack Rhysider EP 26 Details
“NIST, a government-ran standards board, comments on this specifically”
IRS Get Transcript breach INVOLVES Instant knowledge-based authentication
Attackers defeated the IRS's instant KBA by using personal information obtained from other breaches.
Explicit Confidence 96% · Jack Rhysider EP 26 Details
“probably by using some personal information they obtained from other breaches”