[dredmorbius]

The overall risk runs a few different ways. One is that you yourself will bee at risk, another is that there will be a high number of compromises.

There are about 300 in the U.S. of over 100k population (corollary: the other 34,700 locations have fewer than 100k people each, or are at most 10% of the population). A 1/300 chance of cracking a security question on any given transaction is pretty good odds. Particularly if the crack is then reusable.

Another 10% of the U.S. population (roughly) lives in the 10 largest cities alone. That's a 1% likely success rate based on just ten values.

The point being that "legitimate sounding but fabricated" may still not be a particularly good option.