The FFIEC's Supplemental Guidance on Internet authentication dated June 28, 2011 states that financial institutions should no longer consider basic challenge questions an effective primary control.The FFIEC's Supplemental Guidance on Internet authentication dated June 28, 2011 states that financial institutions should no longer consider basic challenge questions an effective primary control.