Security questions are pretty boring and stereotypical (like, "what's your mother's maiden name?" and "on what street did you grow up?") which are fine, but... predictable and unsafe.