They must be using KBA (knowledge based authentication) service for identity checks. There are data aggregator companies (big ones are the credit bureaus but t

They must be using KBA (knowledge based authentication) service for identity checks. There are data aggregator companies (big ones are the credit bureaus but there are others as well) who compile all sorts of orthogonal data points about you (like the color of your first car, your mortgage amount) and in theory generate identity check questions that only the real you can answer all of them correctly. Some more info: http://www.rsa.com/press_release.aspx?id=9459 http://www.rsa.com/press_release.aspx?id=9459