I believe it's a combination of both. The authentication questions are often something quite basic that an account hijacker might not be in possession of, unles

I believe it's a combination of both. The authentication questions are often something quite basic that an account hijacker might not be in possession of, unless they bought basically a full identity theft kit/data set from some data dump. Like residential address, date of birth, last four digits of the credit card or current billing method, etc.