Knowledge-based authentication (KBA) is one of the most specific and widely misunderstood identity verification tools in the e-signature world. It's required by law for remote online notarization in most states. It's required by regulatory frameworks in financial services and healthcare for certain transaction types. It's increasingly used by legal and real estate professionals for high-value agreements where identity certainty matters more than signing convenience. And it's completely invisible to most e-signature buyers until the moment they need it and realize their platform doesn't offer it.
This guide explains what KBA is, how it works technically, when it's legally required, and when it's worth adding even when it isn't.
What Is Knowledge-Based Authentication?
KBA is an identity verification method that challenges a person with questions drawn from their personal financial and public records. Unlike a password (something you know by choice) or a government ID (something you possess), KBA is based on information in your credit file and public records — previous addresses, vehicle registrations, mortgage lenders, court records, and similar data. The questions are dynamically generated from this data in real time and cannot be answered from publicly available information alone.
A typical KBA challenge presents 4–5 multiple-choice questions with a strict time limit (usually 2–3 minutes total). Examples of KBA question types:
- "Which of the following addresses have you lived at in the past 10 years?" (with one correct answer and several plausible incorrect options)
- "Approximately when did you open a mortgage with [lender name]?" (with date ranges as answer choices)
- "Which of the following vehicles have you registered in your name?" (with the correct vehicle and several others as options)
- "Which of the following individuals has lived at the same address as you?" (drawn from shared-address records)
The challenge is designed to be answerable by the real person and difficult to answer by anyone who has only the person's name, date of birth, and Social Security Number — the information typically available from a data breach or dark web purchase.
How KBA Is Scored
KBA providers (the companies that supply the question-answer service to platforms like Zignature) use credit bureau data and public records to generate questions and evaluate responses. A passing score — typically 80% correct answers, sometimes higher — is required. Partial credit is not usually awarded; either the question is answered correctly within the time limit or it is not.
Several factors affect KBA pass rates for legitimate users:
- Thin credit file: People with limited credit history have fewer data points for question generation. KBA may generate questions about very old addresses or vehicles, which legitimate users may have difficulty recalling accurately.
- Recent address changes: Moving frequently makes address-based questions harder to answer with certainty.
- Shared finances: People who share financial accounts with family members may have records intermingled with others, creating ambiguous questions.
- International signers: KBA relies on U.S. credit bureau and public records data. Non-U.S. residents often cannot complete standard KBA at all, requiring alternative identity verification methods.
High-tier KBA providers (LexisNexis, Experian) have pass rates of 85–92% for legitimate U.S. residents. Lower-tier providers using thinner data sets have lower pass rates — meaning more legitimate signers fail and must be handled through alternative channels.
When KBA Is Legally Required
Remote Online Notarization (RON)
Every state with RON legislation requires knowledge-based authentication as one of the identity verification layers before the notary can apply their seal. RON without KBA is not legally valid RON in any U.S. jurisdiction. If a RON platform doesn't include KBA, it cannot legally perform RON in any state — regardless of what its marketing says.
Financial Services Transactions
FINRA, SEC, and state securities regulators require "customer due diligence" for certain transaction types. For electronic account openings and certain investment agreement signings, KBA is one of the recognized methods for satisfying identity verification requirements under these frameworks. Specific rule applicability varies by transaction type and account category.
MISMO/GSE Mortgage Standards
Fannie Mae and Freddie Mac's guidelines for eClosings and eMortgages include identity verification requirements for the electronic loan package. KBA is specifically cited as an acceptable verification method in MISMO's Electronic Signature Security Standard. Lenders and title companies conducting digital closings under GSE guidelines should verify that their e-signature platform's KBA implementation meets MISMO standards.
When KBA Is Worth Adding Even When It Isn't Required
Beyond regulatory mandates, there are business contexts where KBA adds meaningful risk reduction:
High-Value Contracts
Any agreement where the financial consequence of a forged or unauthorized signature is significant — acquisition documents, employment agreements with equity components, partnership agreements, major vendor contracts — benefits from stronger identity verification. KBA adds a layer that email verification alone doesn't provide.
Agreements With Litigation History
Some document types are more commonly challenged in court. Employment non-competes, non-disclosure agreements, and settlement agreements are frequently litigated. A KBA pass result, stored in the audit trail alongside the signature, strengthens the evidentiary record that the correct person signed.
Consumer-Facing Documents With Fraud History
If your business has experienced fraudulent signings — someone submitting a contract under another person's identity — adding KBA to the signing workflow creates a barrier that most fraudsters cannot clear.
KBA vs. Government ID Verification: Which Is Better?
KBA and government ID verification (credential analysis) measure different things. KBA verifies that the person knows information in their personal financial history — information hard to obtain even with a stolen identity. Government ID verification checks that the person possesses a government-issued document and matches its photo. They're complementary, not interchangeable:
- KBA catches identity fraud where the attacker has the victim's personal information but not their physical ID
- Credential analysis catches fraud where the attacker has a stolen or forged physical ID
- Combined KBA + credential analysis catches the vast majority of identity fraud scenarios
For RON, both layers are required. For high-value non-notarized contracts, the appropriate choice depends on your specific risk profile — a legal or compliance advisor should be consulted for regulated industry decisions.
How KBA Works in Zignature
Zignature's KBA is powered by a Tier-1 identity verification provider and integrated directly into the signing flow. When a sender configures a document to require KBA, the signer encounters the identity verification step before accessing the document. The challenge is presented in the signing interface — no redirect to a third-party site required. Results (pass/fail, timestamp, IP address, question set hash) are recorded in the document's audit trail.
For RON sessions, KBA runs automatically as part of the pre-session identity verification, combined with credential analysis (government ID scan and liveness detection). The notary reviews the combined result before beginning the live session.
KBA is available on Zignature as a per-use add-on priced at $9.99 per verification. Volume pricing is available for Enterprise customers with high KBA demand. Learn more about Zignature KBA or start a free account to test identity verification in your workflow.