My bank (HDFC India) specifically states while setting up the security question that the bank will never ask for these (over phone or elsewhere), so I'm happily using random UUIDs
HDFC appears to have truly terrible security, someone managed to sign up with my email address and a really weird mailing address - like an airport warehouse or something, then proceeded to fill up the card and never paid it back. I emailed HDFC about it but they never responded.
Apparently they don't even do e-mail verification.
What is the point of a security question if they never use it?
Asking you to fill them online for password recovery etc?
Yes, they use it for 2FA sometimes on netbanking transactions.