Why Password Reset Questions Should Be More Inclusive

That ping was of another inbox reminder of my monthly statement. It was time to finally roll over my remaining 401k balance, which felt somewhat like a ceremonial severance of all ties to my most recent role as a UX designer from my last employer (due to COVID-19). Months have now passed and it was a prime time for addressing any loose ends before moving on, with chins still up.

The first two attempts to sign in to my 401k account were unsuccessful. My mind had already begun to purge the passwords related to the workplace. (Do I risk a third try?) I hold my breath at the thought of being locked out and having to resort to my password manager. Pushing this off for another day or week was tempting. If not now, it’d be months before I would remember to keep with this small, but significant task to keep up with my own personal finances.

Gone are the days of reusing simpler passwords, as the frustrations for increased security around every corner is real. What was that awkward special symbol, or that pesky capital letter? This moment brought back the empathy I felt for my previous bank clients who I helped to enroll or reset their online banking.

These clients were often not the millennial and later kind, but more-so the less internet-savvy. Some were from an older generation who have escaped the need for digital tools to check their inboxes or even had any use for an email address. Fewer were those that had never used a tablet before. But many were those newer to the country and the English language most times, navigating some of their first American experiences by way of banking and doing it on the internet at the same time.

I was not only responsible for setting up each person’s bank account but also furthered the customer experience by spending a few extra minutes to set up their account access. I sat side-by-side with a shared iPad and helped interpret questions (often in my terrible Spanglish, or simplified vocabulary, or even worse my Chinglish) before prompting them to type in their responses. Each time, we were up against the inevitable step of choosing from a long list of security questions that would be easy enough to answer, but difficult for a hacker to figure out.

Without much thought or effort, I could choose and answer all three requested questions for myself. Though with each of these clients I sat with, there was noticeable patience of time and care in selecting the right question. I could feel the hope was for them that it would be easy enough to recognize on their own if ever faced with needing to reset it alone, instead of having to lean on a son, or daughter, or another family member to be rescued. I’ve been in those shoes before.

When this became a pattern over the anomaly, I paid closer attention to the reset questions being offered:

I noticed that clients often chose ones that brought smiles to their faces and positive memories to mind. These were questions regarding family members or loved ones:

“What is your oldest sibling’s nickname?”

“What is your oldest cousin’s first and last name?”

“What is the first name of your oldest niece?”

“What is your youngest cousin’s first and last name?”

“What is the first name of your oldest nephew?”

The remaining questions had a large theme that asked them to reflect on schooling experiences. Hardly anyone chose the ones that referenced education:

“What was the first and last name of your first roommate during college?”

“What is the first and last name of the person you went to your prom with?”

“What is the last name of your least favorite teacher in high school?”

“What was the last name of your fourth-grade teacher?”

“What was your favorite Halloween costume in elementary school?”

“What is the name of a college you applied to but didn’t attend?”

“What was the last name of your favorite teacher in your final year of high school?”

“What is the name of the band you liked most during high school?”

“What was your favorite restaurant in college?”

“What was your favorite book as a child?”

From a total list of 30 password reset questions, 1 out of 6 questions provided were about family, whereas questions that referenced educational settings were nearly 1 out of 3.

These were moments of unofficial user testing scenarios without hard data collected, but it made me curious to know how these questions were formulated. Who chose these questions? What did this say about the values understated by the individuals and or the business? What kind of ideal user did they have in mind? What assumptions were made about the users? What other potential questions were ruled out? Is there a better question to ask that improves the inclusion of many types of communities? Do these questions offer positive reflection and provide for frictionless answers? What other questions could be used that would appeal to a broader audience using these banking products?

The traditional American educational experience has been under the threat of COVID-19 in 2020, with many campuses across the U.S. sending students back home after outbreaks have disrupted schedules. Grade school students struggle with a new rhythm of learning through a computer screen and being detached from a physically social environment. Special coming of age events of prom, homecoming, and more have been halted to keep people safe. Will this generation of students look back to these changes with great positivity?

According to the U.S. Department of Homeland Security, the average annual number of naturalizations has increased to over 712,000 since 2010. This is just a fraction of the many who come to the U.S. and seek to call it their home for the long haul. Eventually, this population looks towards ways to put their earnings into financial institutions for spending, saving, and engaging through the technology of online banking. How do we accommodate these blending populations and their meaningful cultural influences along with their buying power?

What if instead, we used questions that encompass widely shared human experiences? Answers that don’t just fit very specific populations where there are much fewer chances of individuals feeling left out? What are the experiences that we all already share as humans?

Maybe some of these could more useful suggestions for reset questions:

“What is the main color of your closet?”

“What is a favorite meal you enjoy?”

“Who do you like to spend your time with the most?”

“What is a special skill that you have?”

“Name an activity that brings you happiness.”

“Who do you admire most?”

“What is your favorite song?”

“Where was your last job located?”

“What is your least favorite chore?”

“Name your favorite animal.”

“What does the color yellow remind you of?”

If banking is meant to be a resource for the public that chooses diversity as one of its core values to stand by, I hope that the continued awareness of these micro-interactions within the products and services provided reflect the beliefs that we all as users can enjoy and support right back.