Q: Is it legal for a bank to use my mother's maiden name for security without prior info?

A: Banks are legally required to implement security measures to protect customer information, but there's a significant gray area regarding how they obtain and use security verification data like your mother's maiden name under laws such as the Gramm-Leach-Bliley Act, which requires financial institutions to disclose their privacy policies but doesn't necessarily prohibit them from using this information. While unusual, financial institutions might obtain this information from various sources, including credit bureaus or other databases they have access to, not just from your direct input when opening an account.

Your situation raises valid concerns about transparency and data practices. Under federal privacy laws, banks must notify customers about what personal information they collect and how they use it, but the requirements for prior consent vary depending on the specific circumstances and the source of the information. If you don't recall providing this information and the bank refuses to explain how they obtained it, you have options - you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator, who can investigate whether proper procedures were followed.

For immediate resolution, you might consider requesting alternative security measures. Many financial institutions now offer more robust security options like two-factor authentication or voice recognition that can replace outdated security questions. You can also ask your bank about their process for addressing this kind of situation - they may be able to update your security profile to use information you know you provided. Document all communications with the bank about this issue in case you need to reference them later for a formal complaint.