Signer authentication

Signer authentication is the set of checks an e-signature service uses to confirm that the person opening and signing a document is the intended signer. Also called signer identity verification, it ranges from a unique email link at the lightest end to government ID checks at the heaviest, and the right level depends on how much is at stake.

The most common method is email-based: the signing link goes to one address, so access to that inbox is the first proof of identity. On top of that, platforms can add a one-time passcode sent by text or email, an access code shared out of band, knowledge-based authentication questions, or a scan of a photo ID compared against a selfie. Each extra step raises assurance and also raises the chance a legitimate signer gives up.

Take a freelance designer sending a project agreement to a new client. An email link plus a solid audit trail is usually plenty; if the client later disputes the deal, the record shows the email the link went to, when it was opened, the IP address and device, and the moment of signing. A lender handling a large loan would reasonably want more, such as an OTP or an ID check.

A frequent misconception is that an electronic signature is only valid if the signer was strongly authenticated. US law under the ESIGN Act and UETA focuses on intent to sign and on being able to attribute the signature to a person, and attribution can be shown with ordinary evidence. Stronger authentication makes attribution easier to prove; it is not a precondition for validity.

Signer authentication works hand in hand with the audit trail, which records the evidence, and it connects to specific methods like OTP and KBA, each covered in its own glossary entry.

When choosing a level, ask two practical questions: what would it cost you if someone signed in another person's name, and how likely is that given who you are dealing with? A contract with a long-standing client carries very different risk from a first-time transaction with a stranger online. Your answer should drive the checks, not a vendor's default settings.

Our take: match authentication to the risk, not to your anxiety. For everyday contracts, a unique link plus a thorough audit trail strikes the right balance; piling on hurdles mostly punishes honest signers.

Today eSignSimple authenticates signers through a unique link sent to their email, and signers need no account. Every event is logged with timestamps, IP address and device details, and the finished file gets a SHA-256 hash you can check on our public verify page. SMS or email codes and ID verification are on our roadmap.