Knowledge-based authentication (KBA)

Knowledge-based authentication, or KBA, is an identity check that asks a person questions only they are likely to answer correctly, usually generated from credit files and public records. In e-signature and notarization workflows, KBA verification is used to confirm that a signer is who they claim to be before they can open or sign a document.

There are two flavors. Static KBA relies on answers the user set up earlier, like the classic security question about a first pet. Dynamic KBA, the kind used in signing, pulls questions from data brokers on the fly, such as which of these streets you once lived on or which lender holds a past car loan. The signer typically gets a few multiple-choice questions and a short time limit, and must pass a threshold to continue.

Suppose a property manager is handling a high-value lease guarantee from a guarantor they have never met. Adding KBA means the guarantor must answer questions tied to their credit history before signing, giving the manager extra confidence about identity. For the tenant's routine pet addendum, the same step would be pure friction.

A common misconception is that KBA is nearly foolproof. Much of the underlying data has been exposed in breaches over the years, and a determined fraudster can sometimes find the answers. Honest signers, meanwhile, get tripped up by questions about accounts they barely remember, and people with thin credit files may not be able to generate questions at all.

KBA is one method of signer authentication, and it features heavily in remote online notarization, where many state rules call for it alongside an ID credential check. It is heavier than an OTP, which only proves control of a phone or inbox.

If you do need KBA, tell signers in advance. A short note explaining that they will face a few questions about past addresses or loans, and must answer within a time limit, noticeably reduces failed attempts. It also helps to have a fallback, such as an ID document check, for people whose credit history is too thin to produce questions. Without one, a legitimate signer can end up stuck with no way to complete the document.

Our take: KBA is overkill for everyday contracts. It makes sense where a law or a lender requires it, but for freelance agreements, offer letters or leases, a clean audit trail and a unique signing link do the job with far less friction.

eSignSimple does not use KBA today; ID verification, including methods like KBA, is on our roadmap. We rely on unique email links, an audit trail with timestamps, IP and device details, and a certificate of completion for each signed document.