The IRS’s Knowledge-Based Authentication requirements govern how a taxpayer proves their identity before electronically signing Form 8879 or Form 8878. The rules are specific: tax software must generate identity questions from the taxpayer’s credit records, the taxpayer gets three attempts to answer correctly, and if they fail, the electronic signature option is locked out and a handwritten signature becomes the only path forward. Every attempt, pass or fail, must be logged and preserved by the Electronic Return Originator (ERO). Failure to follow these rules exposes the provider to sanctions that range from a written reprimand to permanent expulsion from IRS e-file.
When KBA Applies and How It Works
KBA is triggered when a taxpayer uses the e-signature option to sign Form 8879 (IRS e-file Signature Authorization for individual returns) or Form 8878 (the authorization used for extensions like Form 4868).1Internal Revenue Service. About Form 8878, IRS e-file Signature Authorization Before the signature is accepted, the software runs an identity check.
A credit reporting company generates the questions in real time from the taxpayer’s credit report. These are not the static security questions the taxpayer set up themselves. They are dynamic multiple-choice items drawn from non-public data: previous addresses, the type of loan held with a particular lender, and similar details.2Internal Revenue Service. Frequently Asked Questions for IRS e-file Signature Authorization The lookup registers as a soft inquiry on the taxpayer’s credit file. It does not affect the credit score, and it is not a credit check in the lending sense.
The Three-Attempt Limit
If the taxpayer answers incorrectly, the software allows retries up to a hard cap. After three failed attempts, the e-signature option is locked out. The ERO must then obtain a handwritten signature on the authorization form.2Internal Revenue Service. Frequently Asked Questions for IRS e-file Signature Authorization There is no software override.
The In-Person Exception
KBA is a remote-transaction requirement. If a taxpayer electronically signs the authorization form while physically present in the ERO’s office and already has a multi-year business relationship with that ERO, no additional identity verification is required for that signing. A multi-year business relationship means the ERO prepared the taxpayer’s return in a prior year and already verified their identity through KBA at that time.2Internal Revenue Service. Frequently Asked Questions for IRS e-file Signature Authorization New clients signing in person still have to go through the verification process.
What the ERO Must Record
Every KBA event, whether the taxpayer passes or fails, has to generate an audit trail. The software must automatically capture and the ERO must preserve the following for each e-signature transaction:
- A digital image of the signed authorization form.
- The date and time the signature was captured.
- The taxpayer’s computer IP address (remote transactions only).
- The taxpayer’s login identification or username (remote transactions only).
- The result of the identity verification (successful or not).
- The method the taxpayer used to sign the record, such as a typed name or a system log reflecting completion of the process.
Records must be kept in a secure storage system.2Internal Revenue Service. Frequently Asked Questions for IRS e-file Signature Authorization Backfilling this documentation after the fact is not an option. Missing records during an IRS review of your e-file operation is a compliance problem on its own.
When a Taxpayer Cannot Pass KBA
Some taxpayers cannot pass KBA no matter how honestly they answer. Young adults with no credit history, recent immigrants, elderly taxpayers who have been off the credit grid for years, and people who have frozen their credit reports all present the same issue: the system does not have enough data to build meaningful questions. The failure says nothing about the taxpayer’s identity.
When KBA fails or cannot be completed, the taxpayer signs the authorization form by hand. The signed form can be returned to the ERO in person, by U.S. mail, private delivery service, fax, email, or through an internet portal.2Internal Revenue Service. Frequently Asked Questions for IRS e-file Signature Authorization The return itself can still be e-filed. Only the signature method on the authorization changes. Practices that regularly serve clients with thin credit files should build a handwritten-signature step into normal workflow rather than treat it as an exception.
Sanctions for Non-Compliance
The IRS applies a tiered sanction structure to e-file security violations, including KBA and record-keeping failures:
- Level One covers violations with little or no impact on return quality or the e-file program. The IRS may issue a written reprimand.
- Level Two covers violations with an adverse impact on return quality or the program. The IRS may restrict e-file participation or suspend the provider, principal, or responsible official for one year.
- Level Three covers violations with a significant adverse impact. The IRS may suspend the provider for two years, or in cases involving fraud or criminal conduct, expel the provider from e-file indefinitely.
Repeated Level Two or Level Three conduct, additional infractions after the IRS has flagged an issue, felony convictions, identity theft involvement, or fraud can escalate a sanction to permanent expulsion.3Internal Revenue Service. IRM 8.7.13 e-file Cases Because most individual returns are now filed electronically, losing e-file privileges effectively closes a tax preparation business.
The Cost of KBA in a Practice
KBA carries a real per-transaction cost. Third-party verification vendors typically charge a per-attempt fee, and the charge hits the firm’s account whether the attempt succeeds or fails. Fees of roughly $1 to $2 per attempt are common across tax software platforms. On a joint return with two signers, one failed first attempt means the firm pays for three verification events on one return.
Merging multiple documents into a single signing event (state and federal returns together, for instance) keeps each signer to a single KBA pass. Firms that serve populations with thin credit histories should plan for a higher failure rate, the added per-attempt charges, and the administrative time spent collecting handwritten fallbacks.
Where KBA Sits in the Broader IRS Identity Framework
IRS e-file identity verification is required to follow the National Institute of Standards and Technology’s Special Publication 800-63, targeting Identity Assurance Level 2 (IAL2) for remote transactions.4National Institute of Standards and Technology. SP 800-63A Implementation Resources – IAL2 Remote Identity Proofing In the current version of SP 800-63, NIST states that knowledge-based authentication “is no longer recognized as an acceptable authenticator” and that knowledge-based verification “cannot be used to satisfy the verification requirements for IAL2 or IAL3 in identity proofing.” The stated reasoning is that attackers can too easily discover the answers, and the limited pool of possible responses makes the method vulnerable.5National Institute of Standards and Technology. NIST SP 800-63 Digital Identity Guidelines – FAQ
Even so, KBA remains the operative IRS standard for electronic signatures on Forms 8879 and 8878. One boundary worth noting: the identity verification you may encounter when logging in to an IRS Online Account, Get Transcript, an Online Payment Agreement, or IP PIN retrieval is a separate system operated through ID.me, not the credit-report KBA that tax software runs at signing.6Internal Revenue Service. New Identity Verification Process to Access Certain IRS Online Tools and Services The two channels share a goal but not a mechanism, and requirements for one do not carry over to the other.