The problem isn't really what questions are being asked, it's that questions are being asked at all. Verify by phone/text, and encourage it's kept up to date (by periodically confirming). It's really convenient/simple and it's more secure than asking a question. Based on the questions you provide, anyone who knows me IRL (friend or not) could easily gain access to my accounts protected by them. This is not true security, it's imagined security. Security just in place to make us feel better.