Once I was on the phone with Blizzard support, and they asked me to verify the answer to one of my security questions. I said “oh, it’s probably just a bunch of random letters” and she said “uh, yeah, it is actually” and let me into my account. So be aware of that as an attack vector too