That's exactly what Troy is talking about in the section on KBA (Knowledge Based Authentication) >Knowledge-based authentication (KBA) is predicated on the ass

That's exactly what Troy is talking about in the section on KBA (Knowledge Based Authentication) >Knowledge-based authentication (KBA) is predicated on the assumption that an individual holds certain knowledge that can be used to prove their identity. It’s assumed that this knowledge is either private or not broadly known thus if the individual can correctly relay it then, with a high degree of confidence, they can prove their identity. KBA is typically dependent on either static or dynamic “secrets” with the former being the immutable data attributes mentioned earlier (date of birth, mother’s maiden name, etc.) and the latter being mutable such as a password.