Know who is signing.

What does e-signature identity verification mean?

By default, most e-signature tools, including eSignSimple today, identify a signer by the email address the link was sent to, backed by an audit trail of timestamps, IP addresses and devices. That is a simple electronic signature, and for most business documents it is legally sufficient and practical.

Identity verification adds a stronger check before someone can sign: an SMS code, a check of a government ID document, or a verification through a bank or national eID scheme. Identity verification is coming soon to eSignSimple and is not live yet.

What are we planning to build?

Nothing described in this section is available today. We plan to start with the checks that add real assurance without making signing painful: a one-time code sent to the signer's phone as a second factor alongside email. If and when it ships, the result of each check would be recorded in the audit trail and certificate of completion so it can be shown later.

We are also evaluating ID document checks through specialised providers for higher-stakes documents. We will only launch those when we are confident in the provider, the privacy terms and the cost to our customers.

How do competitors approach ID verification?

DocuSign, Adobe Acrobat Sign and others offer SMS authentication, knowledge-based questions and ID document verification, usually as paid add-ons charged per verification or bundled into higher plans. In the EU, some providers also offer advanced and qualified electronic signatures through trust service providers, which involve formal identity proofing.

Our opinion: identity verification is valuable, but it is often oversold. Knowledge-based questions built from credit data are weak, and heavy verification on a routine NDA just annoys signers. Match the check to the risk of the document.

When do you actually need stronger verification?

Consider stronger checks for loan and guarantee agreements, high-value sales, documents signed by people you have never met, and situations where you expect the signer might later deny signing. For everyday contracts with known clients, the email link plus audit trail is usually proportionate.

Some documents need more than verification. Where a law or counterparty requires a qualified electronic signature (QES), you need a qualified trust service provider. eSignSimple provides simple electronic signatures and does not offer QES.

What can you do today without ID verification?

Send documents only to email addresses you have confirmed with the signer through another channel, such as a call or an existing email thread. Use signing order so you countersign last after reviewing who signed. Keep the certificate of completion, which records IP address, device and timestamps for each signature.

Anyone can confirm that a completed PDF has not changed by checking its SHA-256 fingerprint on our public verify page. That does not prove identity on its own, but combined with the audit trail it forms a solid record for most business documents.

How do the usual verification methods compare?

Email link only: the signer proves they can read a particular inbox. It is cheap and frictionless, and for most business documents, combined with an audit trail, it is what courts and counterparties are used to seeing. Its weakness is shared or compromised inboxes. This is what eSignSimple does today.

SMS one-time code (OTP): the signer also proves they hold a particular phone number. It adds a second channel, which makes a forged signature harder, but phone numbers can be ported or taken over, and it adds cost per message. Knowledge-based questions (KBA): the signer answers questions drawn from credit records. It is widely used in parts of the US but has been criticised because many of the answers can be found online. ID document checks: the signer photographs a passport or ID card and often takes a selfie that is matched to it. It is the strongest of the four for remote signers and the most intrusive.

None of these, on their own, turns a simple electronic signature into a qualified one. They raise the quality of the evidence about who signed. eSignSimple offers the first method only; the others are not available in our product today.

What does the evidence look like without ID checks?

Here is a realistic example. A freelancer sends a consulting agreement to a client at an address they have used for six months of email correspondence. The audit trail shows the email was sent at 10:14, opened at 10:31 from an IP address in the client's city on a Mac running Safari, and signed at 10:36. The certificate of completion at the end of the PDF lists all of that, and the SHA-256 fingerprint shows the file has not changed since.

If the client later claimed they never signed, they would have to explain who read their inbox, opened the link from their city and signed within minutes of receiving it, and why they kept emailing about the project afterwards. That is the practical strength of an email-based signature: it rarely stands alone, it sits inside a history of dealings. Our guide to what an audit trail records goes into each entry in more detail.

Who decides whether verification is required?

Three sources, usually. The law, where a statute or regulation requires a specific signature type or identification for a document, such as some financial, notarial or property transactions in certain countries. The counterparty, such as a bank or a large customer whose policies demand stronger checks. And you, when the value or risk of the deal justifies extra friction for the signer.

If it is the law or a counterparty, follow their requirement exactly, which may mean using a provider that offers the specific method, a notary or a qualified electronic signature. If it is your own risk call, a phone call to confirm the signer's email before you send is free and often enough. Check local rules for your document type; our legality pages summarise the general position country by country.

What will be verified, and what can you do today?