The basic premise of KBA is this: To log in, users answer a series of multiple-choice questions that are based on data from public records about themsay relating to a real estate purchaseand are gathered by a third-party KBA provider.

For Mellon Investor Services (a subsidiary of Mellon Financial, providing shareholder services and related securities products to small- to Fortune 500size firms), the move to KBA started with a longtime problem, says CTO Marc Librizzi. The firm had a large user population of individual shareholders, and no common data to help authenticate them.

A bottom-line business need drove Mellon to find a new authentication method that was workable: Every time someone chooses the call center instead of the website, it costs the company more money.

First, Mellon Investor Services tried a system in 2006 where shareholders logging in for the first time were sent an investor ID via postal mail, then went online to request an access code, which was sent in a second piece of postal mail. Volume to Mellon's related call center went up. "We needed to allow real-time access to our system," Librizzi says.

So Mellon rolled out a KBA solution from Verid in March 2007. Today, Mellon shareholders get the investor ID by postal mail, then visit the website to answer three multiple-choice questions. If successful, they can set up a PIN and use the system immediately if desired.

What are the questions like? According to Verid COO Chris Rickborn, the company uses data derived from public records, much of it from regulated records available to companies doing ID verification. Questions might include the color of your car, previous addresses, age range of a family member or date of purchase of a property, Rickborn says.

Among the aspects of KBA that Mellon likes, it doesn't maintain the repository of personal data as it would have to with hint-style systems, Librizzi says.

Why not choose an option like RSA-style security tokens? Tokens aren't a regulatory requirement, and dual-factor authentication "isn't realistic with a base of 18 million shareholders," Librizzi says, noting the potential for lost or broken tokens.