Commentary: Authentication questions can keep customers guessing