you Can use all info. that is already captured in your customer account opening form e.g. : Telephone number ( Home , work, Mobile ) ,email address , names ( Mother maiden name ) ,DOB ,card first 4 digits , expiry date , last 2 transactions , last deposit , branch name , Address ,P.O.Box .
a good practice is to develop a group of up to 15 security questions and the customer is asked 4-5 random questions among this group .