KBA and Form 8879: When the IRS Requires an Identity Quiz to E-Sign

Frequently Asked Questions

What is knowledge-based authentication (KBA) in tax?

KBA is an identity check in which the taxpayer answers multiple-choice questions generated from their credit report or other public records, such as a previous address or the lender on an old car loan. In tax practice it is the method the IRS points to for confirming who is on the other end of the screen when a client electronically signs Form 8878 or 8879 without the preparer physically present.

Does Form 8879 require KBA?

Only when the client electronically signs it remotely, meaning the ERO is not physically present. IRS Publication 1345 requires identity verification for those transactions at NIST SP 800-63 Level 2 assurance with knowledge-based authentication or higher. If the client e-signs in your office, or returns a handwritten signature by another route, the KBA rule does not govern that transaction.

When is KBA not required for Form 8879?

Three situations. First, an in-person electronic signature, where you inspect government photo identification instead and a record check is optional. Second, an in-person signature where you already have a multi-year business relationship, meaning you originated returns for that taxpayer in a prior year and verified their identity then. Third, a handwritten signature returned to you by mail, fax, email, hand delivery or a website, which Publication 1345 explicitly excludes from the definition of a remote electronic signature transaction.

Does a wet signature emailed or uploaded back to me require KBA?

No. Publication 1345 states that an electronic signature via remote transaction does not include handwritten signatures on Forms 8878 or 8879 sent to the ERO by hand delivery, U.S. mail, private delivery service, fax, email or an internet website. The client printing the form, signing it by hand, and returning the scan is therefore not a remote electronic signature transaction, so the electronic-signature identity verification rules do not apply to it. Your ordinary professional duty to know your client still does.

What happens if my client fails the KBA questions?

The software must disable identity verification after three attempts. If the taxpayer fails after three tries, Publication 1345 requires the ERO to obtain a handwritten signature on Form 8878 or 8879 instead. There is no fourth attempt and no override, so it is worth warning clients in advance that a thin or frozen credit file can cause a failure that has nothing to do with them being who they say they are.

Does KBA affect my client's credit score?

The record check may create a soft inquiry on the credit report. Soft inquiries are not credit applications and, as general credit-reporting practice, are not used in FICO or VantageScore calculations. Publication 1345 does not itself rule on the effect. It says the signing software should carry an advisory covering how third-party data is used, whether a soft inquiry will be generated, its effect if any on the report, scores and reporting to lenders, and how it may appear, along with an advisory that the IRS gets no access to the credit report.

What records must I keep for an e-signed 8879?

The software must record a digital image of the signed form, the date and time of the signature, the taxpayer's IP address and login username for remote transactions, the identity verification result (passed KBA, or confirmation that photo identification was checked in person), and the method used to sign or an audit trail of the signing. The ERO must be able to produce all of it to the IRS on request.

About the author

Rashad Bayram

Writer & technology consultant focused on Islamic finance, halal Bitcoin, AI agents, and startups. Exploring ideas that matter with care and curiosity.