Knowledge-based authentication challenge questions come from data associated with an individual. This can be from a credit bureau, a DMV or government entity, a mobile carrier or another secure source. Reputable KBA providers never share data or results with non-authorized individuals.