Verify a signer's identity with KBA

You can ask Tidyflow to confirm a signer’s identity before they can open a document you send for electronic signature. The signer answers a few multiple-choice questions drawn from public records, a method called knowledge-based authentication (KBA). Identity checks work for signers in the United States who have a Social Security number.

---

When to use an identity check

An identity check is useful whenever an emailed link is not enough proof of who signed. The most common case for US firms is IRS Form 8879 (and Form 8878) signed remotely: IRS Publication 1345 requires the taxpayer’s identity to be verified through third-party knowledge-based authentication before a remote electronic signature counts.

Other documents where firms turn it on include engagement letters, IRS Form 8821 or 2848 authorizations, and Section 7216 consent forms.

The check is optional and off by default. You choose it for each signer on each request.

---

How to require an identity check on a signature request

1. Open the PDF’s menu and select Request signature, or open the signature setup for a document attached to a client request.
2. Add the signer’s legal name, as it appears on the document, and their email address. The check confirms that the person signing is the person you named.
3. In the Identity check (KBA) column, switch the check on for that signer. If the request is already in the field editor, open Manage signees to find the same column.
4. Place your fields and send the request as usual.

For a joint return, switch the check on for both spouses. Each signer completes their own check.

The Identity check (KBA) column appears for firms in the United States.

---

What the client sees during an identity check

When the client opens their signing link, they see Confirm your identity instead of the document.

1. The client agrees to share their details with the identity verification provider.
2. The client enters their legal name, date of birth, home address and full Social Security number. The name must match the name on the request. Tidyflow sends these details to the provider to find the client’s records. It keeps the name and the last four digits of the Social Security number, but not the full number, the date of birth or the address.
3. The client answers five multiple-choice questions, such as past addresses or vehicles. Each question has a “None of the above” option.
4. When the answers are correct, the document opens and the client signs it as usual.

A client who answers incorrectly gets a new set of questions. Each signer has three attempts. An attempt is also used when the provider can’t find records for the details the client entered.

If the client confirms their identity and then opens the signing link in another browser or on another device, they’re emailed a 6-digit code to continue. Someone else who has the link can’t sign on the strength of the client’s check.

---

What happens when a signer cannot pass the identity check

After three unsuccessful attempts, or when the provider cannot find enough records to build questions, the signing page switches to Sign by hand instead. This often happens for clients with an ITIN instead of a Social Security number, clients who recently moved to the United States, or clients with very little credit history.

The client downloads the document, signs it on paper, and uploads a scan or photo with Upload signed copy. Tidyflow saves the hand-signed copy next to the original document and emails you so you can review it. Review the copy before relying on it, then complete any related client request item yourself.

For IRS Form 8879 and 8878, a form signed by hand and returned by upload, email or fax is not a remote electronic signature, so it doesn’t need an identity check. Keep the signed copy with your records as usual.

If the provider couldn’t find records for the details the client entered, often because of a typo, you can let them try again online. Open the document’s menu in the client’s Files tab and select Allow another identity check. The signer gets three new attempts. This isn’t offered once a client has answered a set of questions incorrectly, because the IRS then requires a handwritten signature.

If you cancel the request and send it again, signers who passed need to pass a new check. Signers who couldn’t pass still sign by hand.

---

Where identity check results are recorded

The files list shows Identity verified, Identity check failed or Signed by hand next to the document. Every attempt is recorded in the document’s history. For a passed check, the history shows the verified legal name and the last four digits of the Social Security number, so you can match them to the return. The Certificate of Completion added to the signed PDF lists every signer with how their identity was checked, when they consented and when they signed, with the IP address. A passed check shows as Verified by KBA with the verified legal name.

The completed PDF is sealed with Tidyflow’s digital signature. PDF readers show the signature as invalid if anything in the document changes. The signing history download lists the signed copy’s SHA-256 fingerprint so you can check any copy against the stored one.

A signed document where any signer had an identity check, and a hand-signed copy uploaded instead, can’t be deleted until the end of the third year after the year it was signed. Resetting the workspace or closing the account still removes them, so export your records first.

---

Frequently asked questions

Does an identity check cost extra?

Identity checks are free while the feature is in beta. A monthly limit per firm applies during the beta.

Can signers outside the United States use the identity check?

No. The questions come from US public records and need a Social Security number. Leave the identity check off for signers outside the United States.

Do business returns need an identity check?

IRS Publication 1345 sets the identity check rule for Forms 8879 and 8878 signed remotely for individual returns. The business versions, such as Form 8879-CORP, 8879-PE and 8879-S, have no published IRS identity check rule. You can still turn the check on for the person signing for the business.

Does the identity check replace the access code?

No. They are separate. An access code is a code you give the signer yourself. The identity check confirms the signer is the person named. You can use either or both.