Is KBA required for Remote Online Notarization (RON)?

Yes. The vast majority of US states with Remote Online Notarization statutes require identity proofing through credential analysis plus KBA. States including Florida, Texas, Virginia, Ohio, Nevada, and 35+ more specifically require that notaries use a KBA-based identity proofing service that meets MISMO standards. Zignature's KBA integration is MISMO-compliant and satisfies the identity proofing requirements of all major RON state statutes.

How accurate is KBA verification?

KBA accuracy depends on the quality of the underlying data source. Zignature's KBA is powered by Authenticate.com, which sources questions from Equifax and LexisNexis public records databases — among the largest and most accurate identity data sources in the US. Genuine identity owners typically score 80% or higher. A passing score requires correctly answering at least 3 of 5 questions within the time limit. Signers who fail twice are blocked and cannot retry — preventing brute-force attempts.

Is KBA data stored by Zignature?

No. Zignature does not store KBA question content, answer choices, or the signer's responses. The questions are generated by the KBA provider (Authenticate.com) in real time and evaluated server-side. Only the final result — pass or fail, score, attempt number, timestamp, and IP address — is retained in the tamper-evident audit log attached to the completed document. Personal financial data used to generate questions is never persisted in Zignature's systems.

Knowledge-Based Authentication

MISMO · NIST IAL2 · RON

The questions only you can answer.

Q: What is Knowledge-Based Authentication (KBA)?

Knowledge-Based Authentication (KBA) is an identity verification method that confirms a person's identity by asking multiple-choice questions drawn from credit bureau and public records data — information only the real person should know, such as previous addresses, past lenders, and vehicle history. Unlike passwords, KBA questions are generated dynamically from third-party data, making them resistant to social engineering. KBA is required for Remote Online Notarization (RON) in most US states and satisfies NIST 800-63 Identity Assurance Level 2 (IAL2) requirements.

Q: What types of questions does KBA ask?

KBA questions are generated from credit bureau and public records data and fall into several categories: address history (previous ZIP codes or street addresses), financial history (past lenders, loan amounts, or credit card issuers), property and vehicle records (past employers or vehicle makes associated with the identity), and personal history (relatives' names from public records). Each question is a multiple-choice format with one correct answer and three plausible distractors. The correct answers are never stored by Zignature — only the pass/fail result and score are retained.

Q: What happens if a signer fails KBA?

If a signer fails KBA on the first attempt, they receive a second attempt with a fresh set of questions. If they fail a second time, the session is locked — no further KBA attempts are permitted for that session. The failure is recorded in the audit trail with the score, attempt count, timestamp, and IP address. The notary or workflow administrator is notified. This two-attempt limit prevents brute-force guessing while giving legitimate signers who made an error a second chance.

Q: Does KBA work for people with thin credit files?

KBA relies on credit bureau and public records data, which means individuals with thin or no credit history — recent immigrants, young adults, or people who primarily use cash — may not have sufficient data for KBA questions to be generated. In these cases, Zignature automatically falls back to Government ID + Liveness verification via Stripe Identity, which verifies a physical government document and biometric match instead. This hybrid approach ensures verification coverage without excluding thin-file individuals.

Q: What compliance standards does Zignature's KBA meet?

Zignature's KBA meets MISMO identity proofing standards (required for RON in most states), NIST Special Publication 800-63-3 Identity Assurance Level 2 (IAL2), the ESIGN Act (15 U.S.C. § 7001) requirements for electronic record attribution, UETA Section 9 attribution requirements, and state-specific RON statutes including Florida Statute 117.265, Texas Government Code 406.110, and Virginia Code 47.1-6.1. The KBA audit trail satisfies 21 CFR Part 11 requirements for regulated life sciences workflows.

Knowledge-Based Authentication is the identity verification gold standard for Remote Online Notarization — required by law in 40+ states. Zignature's KBA generates real, out-of-wallet questions from credit bureau and public records data in real time, verifies answers in under 60 seconds, and produces a MISMO-compliant audit trail that stands up in court.

Legally required for RON — satisfies identity proofing statutes in 40+ states

Credit bureau sourced — Equifax + LexisNexis data, not self-reported answers

Under 60 seconds — no friction for real signers, real-time scoring

Zero PII stored — question content and answers are never persisted

Try KBA for free See RON features

Identity Verification

Question 3 of 5

2:00 remaining

Address History

Which of the following street names is associated with an address where you have lived?

Maple Creek Drive

Peachtree Boulevard

Willow Springs Road

None of the above

Running score: 85/100

2 of 3 answered correctly · Passing threshold: 70

What is KBA?

The only verification method built on what only you know

Knowledge-Based Authentication (KBA) is a remote identity verification technique that confirms a signer's real-world identity by asking questions drawn from their financial and residential history — data sourced from credit bureaus and public records that the real person would know, but a fraudster using stolen credentials would not.

Unlike password-based authentication or email OTPs, KBA is an out-of-wallet verification method. The questions are never shared in advance, can't be Googled, and are generated dynamically for each session. Even if a bad actor had the signer's name, address, and Social Security Number, they would still need to know which apartment building the signer lived in three years ago, or which credit card issuer they used in 2021.

This makes KBA the gold standard for Remote Online Notarization identity proofing — and the reason 40+ states specifically require it in their RON statutes.

KBA vs. other methods

KBA (out-of-wallet) Best for RON

Questions from credit bureau + public records. Cannot be answered from a data breach alone.

IAL2

Email / SMS OTP Low assurance

Confirms access to a device or inbox — not identity. SIM swap and phishing trivially bypass OTP.

IAL1

Security questions (self-set) Not suitable

User-configured questions are discoverable via social media, data breaches, and social engineering.

IAL0

Gov't ID + Liveness Complementary

Biometric + document verification. Higher assurance, requires camera access. Stack with KBA for RON.

IAL2+

How It Works

Zero setup. Done in under 60 seconds.

Zignature's KBA is embedded directly in the signing flow. Signers never leave the document to a third-party verification portal — it's all inline, instant, and seamless.

Signer receives document link

The notary or workflow sends the document. The signer clicks the signing link — no account creation, no app download. The document opens directly in their browser.

PII collection — encrypted in transit

The signer enters basic identifying information: first and last name, date of birth, last 4 digits of SSN, and current ZIP code. This data is transmitted over TLS 1.3 directly to the KBA provider — Zignature never stores it.

Real-time question generation

The KBA engine (powered by Authenticate.com, sourcing Equifax and LexisNexis data) generates 5 multiple-choice questions unique to this signer's identity. Questions rotate with each attempt — no reuse.

Timed quiz — 2 minutes per question

Each question has a time limit. The signer selects their answer from 4 options. A genuine identity owner typically completes all 5 questions in under 90 seconds. Fraudsters, who need time to look up answers, run out of time.

Real-time scoring + pass/fail decision

Answers are evaluated against the verified data source in real time. A score of 70+ out of 100 is a pass. The score, attempt number, timestamp, and IP address are logged. A fail triggers attempt 2 with new questions — two fails lock the session.

Audit trail sealed to document

The KBA result — pass/fail, score, attempt count, timestamp, IP address — is cryptographically sealed into the document's audit trail. This trail is attached to the final PDF and retained for 10 years. Admissible under ESIGN Act and UETA.

KBA Data Flow — What Goes Where

Signer

Enters name, DOB, SSN4, ZIP

TLS 1.3

Authenticate.com

Generates questions, evaluates answers

Result only

Zignature

Stores only: pass/fail, score, timestamp, IP

Zero PII retained by Zignature. Question content, answer choices, and the signer's responses are evaluated and discarded by Authenticate.com. Only the final scored result reaches Zignature's systems — and only the audit-trail metadata is stored.

What kinds of questions does KBA ask?

Questions are generated from multiple data categories to build a multi-dimensional identity portrait that's hard to spoof from a single data source.

Address History

Questions about previous street names, ZIP codes, cities, or apartment numbers associated with the signer's residential history — sourced from credit bureau files and utility records.

"Which of the following street names is associated with a previous address?"

Financial History

Questions about past lenders, credit card issuers, loan types, or approximate loan amounts from the signer's credit history — information that's on a credit report but not typically searchable online.

"Which company previously held a mortgage for you?"

Vehicle Records

Questions about vehicle make, model, year, or color from DMV and insurance records associated with the identity — cross-referenced with address history to further confirm identity.

"Which of the following vehicles have you owned?"

Associates & Relatives

Questions about names of relatives or people who have shared an address — sourced from public records and credit bureau data. These questions are cross-checked to prevent identity confusion with family members.

"Which of the following names is associated with a relative of yours?"

Employment History

Questions about past employers, industry, or approximate employment dates from payroll and insurance records. This data source is particularly effective for mid-career professionals with established employment records.

"Which of the following companies have you worked for?"

Property Records

Questions about property ownership, assessed value ranges, or county of record for real property associated with the identity. Particularly valuable for mortgage and real estate RON workflows.

"In which county did you own property as of 2022?"

RON State Compliance

Required by law in 40+ states.
We meet every one.

Every state with a Remote Online Notarization statute that mandates identity proofing requires at minimum credential analysis + KBA. Zignature's KBA implementation satisfies the statutory requirements of all major RON states.

MISMO-compliant identity proofing

Satisfies the MISMO Remote Online Notarization standards adopted by most states as the technical benchmark for KBA quality.

Tamper-evident journal + video recording

RON sessions include journal logging and recorded video — both required by most state statutes and retained for the statutory minimum period.

2-attempt limit enforced at platform level

State RON statutes prohibit unlimited KBA retries. Zignature enforces the 2-attempt maximum at the session level with no override available.

KBA Required — Key State Statutes

Florida

§117.265 — KBA + credential analysis required

Texas

Gov. Code §406.110 — MISMO-standard KBA

Virginia

Code §47.1-6.1 — Identity proofing with KBA

Ohio

ORC §147.60 — KBA for remote notarization

Nevada

NRS §240.181 — Credential analysis + KBA

Pennsylvania

57 Pa. C.S. §312 — Identity verification + KBA

View all 40+ supported RON states →

KBA Failure Handling

What happens when KBA fails?

KBA failure is rare for genuine identity owners — but it happens. Thin credit files, people who haven't used credit in years, or individuals who've moved frequently may not have enough data in the credit bureau system for questions to be generated, or may struggle to remember distant financial history.

Zignature handles failure cases gracefully — protecting the security of the workflow while offering genuine users a clear path forward.

First failure → Second attempt

A fresh set of questions is generated from a different data category. Score and timestamp are logged for the failed attempt. The notary can see attempt status in real time.

Second failure → Session locked

The session is locked. No further KBA attempts are possible for this session. The notary is notified. Fraud deterrence is preserved — brute-force is impossible within the 2-attempt window.

Thin file? → Automatic ID + Liveness fallback

When the KBA provider cannot generate sufficient questions (thin credit file), Zignature automatically routes the signer to Government ID + Liveness verification via Stripe Identity — no friction, no dead end.

Notary Panel — KBA Status View

Sarah M.

Passed on attempt 1 · Score: 90/100

Verified

James T.

Passed on attempt 2 · Score: 75/100

Verified (2nd attempt)

Unknown signer

Failed both attempts · Session locked

Failed — Locked

Maria L.

KBA unavailable — routed to ID + Liveness

ID Verified

Everything about KBA

Detailed answers to the questions notaries, legal teams, and compliance officers ask most.

What is Knowledge-Based Authentication (KBA)?

KBA is a remote identity verification method that confirms a person's identity by asking multiple-choice questions from credit bureau and public records data — information only the real person should know, such as previous addresses, past lenders, vehicle history, and relatives' names. Unlike passwords or PINs, KBA questions are dynamically generated for each session and sourced from third-party databases, making them extremely difficult to answer correctly without actually being the person.

What types of questions does KBA ask?

Questions are drawn from multiple data categories: address history (previous street names, ZIP codes), financial history (past lenders, credit card issuers, loan types), vehicle records (DMV-sourced vehicle make/model), property records (counties of ownership), associates/relatives (names from shared addresses), and employment history (past employers). Each session generates 5 questions from a mix of categories. Correct answers are never stored — only the pass/fail score and metadata.

Is KBA required for Remote Online Notarization?

Yes — in the vast majority of states. All 40+ states with active RON statutes require some form of identity proofing, and most specifically require KBA that meets MISMO identity proofing standards. States like Florida (§117.265), Texas (Gov. Code §406.110), Virginia (§47.1-6.1), Nevada (NRS §240.181), and Ohio (ORC §147.60) each mandate credential analysis plus MISMO-compliant KBA. Zignature's KBA implementation satisfies all of these statutes.

What happens if a signer fails KBA?

A first failure triggers a second attempt with a new set of questions from different data categories. If the signer fails again, the session is permanently locked — no further attempts are allowed for that session ID. This two-attempt limit is enforced at the platform level and cannot be overridden. The failure, including both scores and timestamps, is recorded in the audit trail. If the KBA provider cannot generate questions (thin credit file), Zignature automatically routes the signer to Government ID + Liveness as a fallback.

Does Zignature store KBA answers or PII?

No. The signer's PII (name, date of birth, SSN last 4, ZIP code) is transmitted directly to Authenticate.com over TLS and is not stored in Zignature's systems. Question content, answer choices, and the signer's responses are evaluated entirely within the KBA provider's infrastructure and discarded after scoring. Only the final result — pass or fail, score, attempt count, timestamp, and IP address — is returned to Zignature and stored in the audit log. The audit log contains no personally identifiable question content or responses.

What compliance standards does Zignature's KBA satisfy?

Zignature's KBA meets: MISMO Remote Online Notarization standards (adopted by most states as the technical benchmark); NIST SP 800-63-3 Identity Assurance Level 2 (IAL2); ESIGN Act (15 U.S.C. § 7001) requirements for electronic record attribution; UETA Section 9 attribution requirements; 21 CFR Part 11 for regulated life sciences; and all major state RON statutes including Florida §117.265, Texas Gov. Code §406.110, and Virginia §47.1-6.1.

Does KBA work for people with thin credit files?

KBA relies on credit bureau and public records data, so individuals with thin credit history — recent immigrants, young adults, or people who primarily use cash — may not have enough data for questions to be generated. When this occurs, Zignature automatically routes the signer to Government ID + Liveness Detection via Stripe Identity instead. This fallback verifies a physical government-issued document plus a real-time biometric selfie, providing equivalent or higher identity assurance without turning the signer away.

The questions only you can answer.

The only verification method built on what only you know

Zero setup. Done in under 60 seconds.

Signer receives document link

PII collection — encrypted in transit

Real-time question generation

Timed quiz — 2 minutes per question

Real-time scoring + pass/fail decision

Audit trail sealed to document

What kinds of questions does KBA ask?

Address History

Financial History

Vehicle Records

Associates & Relatives

Employment History

Property Records

Required by law in 40+ states.We meet every one.

What happens when KBA fails?

Everything about KBA

What is Knowledge-Based Authentication (KBA)?

What types of questions does KBA ask?

Is KBA required for Remote Online Notarization?

What happens if a signer fails KBA?

Does Zignature store KBA answers or PII?

What compliance standards does Zignature's KBA satisfy?

Does KBA work for people with thin credit files?

KBA that actually stands upin court. Out of the box.

Required by law in 40+ states.
We meet every one.

KBA that actually stands up
in court. Out of the box.