Considering the security question forms are brute-force proof, I think it's better to keep fictional answers which cannot be accessed by social engineering for

Considering the security question forms are brute-force proof, I think it's better to keep fictional answers which cannot be accessed by social engineering for these questions. In India we have SMS based 2FA for transactions in spite of these questions, Some Chinese banks seems to provide HW based 2FA for general accounts.