Methods and systems for leveraging transaction data to dynamically authenticate a user

An authenticating computing device for use in authenticating a candidate user accessing a host computing device as an authentic user, the host computing device in communication with the authenticating computing device, the authenticating computing device comprising a memory and a processor coupled to the memory, the processor configured to:

• receive an authentication request for accessing secure data stored on the host computing device, the secure data not including transaction data;
• retrieve, from a database, the transaction data associated with the authentic user based on a user identifier;
• generate a challenge question and a correct answer to the challenge question based on the transaction data associated with the authentic user;
• generate a plurality of incorrect answers to the challenge question by comparison to the transaction data;
• and
• transmit the challenge question, the correct answer, and the plurality of incorrect answers to the host computing device without exposing the transaction data to the host computing device.

A non-transitory computer readable storage medium having computer-executable instructions for authenticating a candidate user accessing a host computing device as an authentic user embodied thereon, wherein, when executed by at least one processor, the computer-executable instructions cause the at least one processor to:

• receive an authentication request for accessing secure data stored on the host computing device, the secure data not including transaction data;
• retrieve, from a database, the transaction data associated with the authentic user based on a user identifier;
• generate a challenge question and a correct answer to the challenge question based on the transaction data associated with the authentic user;
• generate a plurality of incorrect answers to the challenge question by comparison to the transaction data;
• and
• transmit the challenge question, the correct answer, and the plurality of incorrect answers to the host computing device without exposing the transaction data to the host computing device.