Knowledge-based authentication (KBA)

What does Knowledge-based authentication mean?

Knowledge-based authentication, or KBA, is an identity check that asks a person questions only they are likely to answer correctly, usually generated from credit files and public records. In e-signature and notarization workflows, KBA verification is used to confirm that a signer is who they claim to be before they can open or sign a document.

There are two flavors. Static KBA relies on answers the user set up earlier, like the classic security question about a first pet. Dynamic KBA, the kind used in signing, pulls questions from data brokers on the fly, such as which of these streets you once lived on or which lender holds a past car loan. The signer typically gets a few multiple-choice questions and a short time limit, and must pass a threshold to continue.

Suppose a property manager is handling a high-value lease guarantee from a guarantor they have never met. Adding KBA means the guarantor must answer questions tied to their credit history before signing, giving the manager extra confidence about identity. For the tenant's routine pet addendum, the same step would be pure friction.

A common misconception is that KBA is nearly foolproof. Much of the underlying data has been exposed in breaches over the years, and a determined fraudster can sometimes find the answers. Honest signers, meanwhile, get tripped up by questions about accounts they barely remember, and people with thin credit files may not be able to generate questions at all.

KBA is one method of signer authentication, and it features heavily in remote online notarization, where many state rules call for it alongside an ID credential check. It is heavier than an OTP, which only proves control of a phone or inbox.

If you do need KBA, tell signers in advance. A short note explaining that they will face a few questions about past addresses or loans, and must answer within a time limit, noticeably reduces failed attempts. It also helps to have a fallback, such as an ID document check, for people whose credit history is too thin to produce questions. Without one, a legitimate signer can end up stuck with no way to complete the document.

Our take: KBA is overkill for everyday contracts. It makes sense where a law or a lender requires it, but for freelance agreements, offer letters or leases, a clean audit trail and a unique signing link do the job with far less friction.

eSignSimple does not use KBA today; ID verification, including methods like KBA, is on our roadmap. We rely on unique email links, an audit trail with timestamps, IP and device details, and a certificate of completion for each signed document.

What is an example of knowledge-based authentication?

A mortgage borrower joins a remote online notarization session. Before the notary appears, the platform asks five multiple-choice questions, such as which of four streets she once lived on, drawn from credit and public records, and she must answer most of them correctly within a time limit. eSignSimple does not offer KBA or any identity verification.

What does a KBA check actually look like for the signer?

The signer usually enters their name, address and often the last digits of a national identifier such as a US Social Security number, so the provider can find their records. The system then shows a handful of multiple-choice questions, for example which county they have lived in, which of four amounts was a past car payment, or which address they are associated with, and always includes a none of the above option. A timer runs, and the signer must reach a pass mark set by the provider or by the rules that apply.

If they fail, they may get a second attempt with fresh questions, after which they are typically locked out for a period. The exact number of questions, the time limit and the number of retries depend on the platform and, for notarization, on state rules. Signers should expect to be asked about things they may have forgotten, such as a credit card closed a decade ago.

Who cannot pass KBA, and what then?

KBA works only for people with enough history in the databases the provider uses, which are mostly US credit and public records. Young adults, recent immigrants, people who have never borrowed, and anyone living outside the countries the provider covers may get no questions at all. Others fail because their records contain errors or belong partly to someone with a similar name.

A sensible workflow plans for that from the start. Offer an alternative such as an ID document check, an in-person meeting, or a notary visit, and tell signers the alternative exists. Otherwise a legitimate guarantor or customer ends up stuck, and your process fails exactly the people it was not meant to stop.

How does KBA fit with other identity checks?

Security guidance has moved away from treating knowledge questions as strong proof. US federal digital identity guidelines have restricted knowledge-based verification for years, and many organisations now pair it with something the person holds, such as a phone for an SMS code, or something they are, such as a face matched against an ID photo. In remote notarization, KBA commonly sits alongside credential analysis of a government ID and the notary's own live view of the signer.

For most small businesses, the real choice is between an email link with a strong audit trail and a provider that offers layered identity checks. eSignSimple offers the first. If your lender, insurer or regulator requires identity proofing, use a provider that supports it for those documents and keep everyday agreements on the simpler flow. Our real estate page explains which property documents usually need the heavier route.

Which terms are related?

• Notarization: Notarization is the process in which a commissioned notary public verifies a signer's identity and willingness, then certifies the signature with a seal.
• Remote online notarization (RON): Remote online notarization (RON) lets a commissioned notary notarize a document over a live audio-video session using electronic signatures and seals.
• Signer authentication: Signer authentication is how an e-signature platform confirms that the person signing a document is the person it was sent to.
• One-time passcode (OTP): A one-time passcode (OTP) is a short code sent to a signer by text or email that must be entered before a document can be opened or signed.