There are provided systems and methods for targeted authentication queries based on detected user actions. A user may perform various actions during a day, including online, electronic, or digital actions, such as social networking, messaging, and media consumption, as well as real-life actions, such as exercise, travel, and purchases. The actions may be used to determine a user history for the user by a service provider. When the user wishes to login to an account or otherwise authenticate the identity of the user, the user may provide login or authentication credentials. The credentials may be used to look up the user history and cause the service provider to generate an authentication query for the user based on events associated with the user in the user history. The query may be utilized to further authenticate the user by requiring the user to respond with the event associated with the user.