A month later they implement the security questions, after a Death-Eater impersonates Lupin, and Luna nearly dies, barely fighting him off before the real Lupin gets there and stuns him. Let's say you’re coming in from a mission, you ask them one, they ask you one. Negative answer, stunning spell at best. Of course, you're meant to incapacitate them until you can confirm identity and they can be used as a source against Voldemort. 