I believe that it's setup that way in order to maintain some sort of standardization of questions and to prevent people from writing questions that are easily g

I believe that it's setup that way in order to maintain some sort of standardization of questions and to prevent people from writing questions that are easily guessable. That's not to say that it isn't doable, as I've had some of my clients ask for this type of functionality before. Most of the time they end up using a predefined (or OOTB - out of the box) list of questions. Take a look at the following article as it describes the various forms of identity proofing pretty accurately. http://unissant.com/identity-proofing-an-introduction/ http://unissant.com/identity-proofing-an-introduction/ Companies have been moving to more complex forms of identity proofing (OTP or Risk based) and it will be only a matter of time till it becomes more mainstream. I hope this answers your question.