Preventing unauthorized access to personal data during authentication processes

A computing device comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the computing device to:
• receive a request for access to an account associated with a user, wherein the request for access comprises candidate authentication information associated with the account;
• query an account database for account data corresponding to the account;
• and
• in response to determining, based on comparing the candidate authentication information with the account data, that a first portion of the candidate authentication information comprises a valid user identifier for the account and that a second portion of the candidate authentication information does not correspond to the account:
• generate, based a first transaction indicated by the account data, a synthetic transaction by:
• processing the account data to determine a plurality of merchants;
• and
• identifying a first merchant not included in the plurality of merchants, wherein the synthetic transaction comprises a synthetic financial transaction conducted at the first merchant;
• generate, based on the synthetic transaction, a synthetic authentication question, wherein the synthetic authentication question indicates that the second portion of the candidate authentication information is valid;
• generate, based on a second transaction indicated by the account data, a different authentication question;
• perform further authentication by causing presentation of the synthetic authentication question and the different authentication question;
• receive a first candidate response to the synthetic authentication question and a second candidate response to the different authentication question;
• and
• deny access to the account.

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause a computing device to:

• receive a request for access to an account associated with a user, wherein the request for access comprises candidate authentication information associated with the account;
• query an account database for account data corresponding to the account;
• and
• in response to determining, based on comparing the candidate authentication information with the account data, that a first portion of the candidate authentication information comprises a valid user identifier for the account and that a second portion of the candidate authentication information does not correspond to the account:
• generate, based a first transaction indicated by the account data, a synthetic transaction by:
• processing the account data to determine a plurality of merchants;
• and
• identifying a first merchant not included in the plurality of merchants, wherein the synthetic transaction comprises a synthetic financial transaction conducted at the first merchant;
• generate, based on the synthetic transaction, a synthetic authentication question, wherein the synthetic authentication question indicates that the second portion of the candidate authentication information is valid;
• generate, based on a second transaction indicated by the account data, a different authentication question;
• perform further authentication by causing presentation of the synthetic authentication question and the different authentication question;
• receive a first candidate response to the synthetic authentication question and a second candidate response to the different authentication question;
• and
• deny access to the account.