IRS Form 8879 KBA requirements for tax preparers

The IRS sets precise standards for electronic signatures on individual returns. When a client signs Form 8879 outside your office, basic e-signature tools that only check an email address fail federal requirements. Electronic Return Originators must follow the mandates established in IRS Publication 1345.

The IRS Publication 1345 framework for e-file authorizations

IRS Publication 1345, titled Handbook for Authorized IRS e-file Providers of Individual Income Tax Returns, governs electronic filing for Form 1040 returns. The handbook outlines legal obligations for Electronic Return Originators, known as EROs.

Before transmitting an electronic return, the taxpayer must review the completed return and sign an authorization under penalties of perjury. Taxpayers authorize transmission of Form 1040 using Form 8879, titled IRS e-file Signature Authorization. When requesting an extension using Form 4868 or Form 2350 with electronic funds withdrawal, the taxpayer signs Form 8878 instead.

The IRS holds the ERO responsible for signature validity. Transmitting returns without a compliant signature risks sanctions, EFIN suspension, or expulsion from e-filing.

In-person verification compared to remote electronic signing

Publication 1345 establishes two distinct paths for verifying taxpayer identity before an electronic signature is accepted.

The first path applies when the taxpayer visits the firm in person. The ERO verifies identity by inspecting a current, valid government photo ID, such as a driver's license, state ID card, or passport. An ERO can also satisfy the requirement through personal knowledge. If the practitioner has an established multi-year relationship with the client, inspecting photo identification each year is unnecessary.

The second path applies to remote electronic signing. When the taxpayer is not physically present, inspecting physical identification is impossible. The IRS prohibits relying on basic email verification. Publication 1345 mandates that remote electronic signatures must use identity verification aligned with NIST Special Publication 800-63 standards, specifically dynamic Knowledge-Based Authentication.

How dynamic Knowledge-Based Authentication operates

Knowledge-Based Authentication, commonly called KBA, validates identity by querying public records, credit reporting files, and consumer databases spanning thirty or more years.

Publication 1345 requires dynamic KBA, generating real-time questions from third-party databases without practitioner intervention. Compliant sessions must satisfy four criteria:

• Out-of-wallet questions. Questions draw on historical records not found in a wallet or purse, such as past street addresses, auto lenders, or mortgage holders. They never rely on easily compromised data like Mother's maiden name.
• Passing threshold. The taxpayer must correctly answer at least three out of four, or four out of five, multiple-choice questions. Missing more than one question fails the session.
• Strict time limits. Providers enforce a short response window, typically two to three minutes, preventing outside research.
• Independent question generation. Questions must originate from an independent data broker, such as Equifax, Experian, TransUnion, or LexisNexis.

The strict three-attempt failure rule under Publication 1345

Dynamic identity questions can be challenging for taxpayers who do not recall old loan records. However, the IRS strictly limits attempts.

Under IRS Publication 1345, a taxpayer is allowed a maximum of three consecutive attempts to pass a dynamic KBA session. If the taxpayer fails the third attempt, the software must lock the taxpayer out from remote electronic signing for that return.

Once three failures occur, the ERO is barred from accepting a remote electronic signature for that return. The practitioner has two lawful options remaining:

• Collect a physical handwritten signature. The client prints Form 8879, signs with pen on paper, and returns the wet-signed form by mail, fax, secure upload, or hand delivery.
• Verify identity in person. The client visits the office with a valid government photo ID and signs on an office tablet or on paper.

Software allowing unlimited retry attempts violates Publication 1345.

Why KBA fails in common tax practice scenarios

Small CPA firms encounter five recurring situations where dynamic KBA fails during tax season:

• Credit file security freezes. Millions of taxpayers maintain credit freezes at Equifax, Experian, and TransUnion. When a file is frozen, authentication services cannot retrieve consumer reports, causing an immediate failure. The taxpayer must temporarily lift the freeze before signing, or provide a handwritten signature.
• Thin credit files for young adults. Dependents aged eighteen to twenty-two and college students have minimal credit history. Without mortgages or auto loans, data brokers cannot generate valid out-of-wallet questions.
• New immigrants and ITIN holders. Lawful permanent residents, visa workers, and Individual Taxpayer Identification Number filers lack years of domestic credit records, almost always requiring wet signatures.
• Recent address changes. Taxpayers who moved within the past year encounter database discrepancies that cause failed attempts.
• Shared household email addresses. Spouses sharing an inbox run into technical locks when software fails to separate the signers.

The spousal signature requirement on joint returns

Married Filing Jointly returns create joint and several tax liability. Because both parties are legally responsible, the IRS requires each spouse to sign Form 8879.

Publication 1345 mandates that both spouses must independently authenticate their identities and independently sign the authorization. A preparer cannot allow one spouse to sign for the other without a formal Power of Attorney on Form 2848 granting explicit authority to sign tax returns.

Standard e-signature platforms often treat an email address as a single user. Sending a joint envelope to a shared inbox, such as [email protected], allows one spouse to sign both names.

Accepting a single session where one spouse signs for both violates IRS rules. A compliant workflow must deliver two distinct, tokenized signing sessions to the shared inbox. Each spouse must open their own unique link, complete separate identity verification questions, and execute their own individual signature. Read our guide on solving the Form 8879 spousal signature problem on shared emails.

Mandatory audit log fields for IRS compliance

During e-file compliance reviews, examiners inspect signature records. EROs must retain Form 8879 and associated records for three years from the return due date or filing date, whichever is later.

Under Publication 1345, a compliant electronic signature audit trail must document six elements:

• Digital image of the completed form. A clear copy of the executed Form 8879 or Form 8878, showing taxpayer numbers and signature fields.
• Exact date and time stamps. UTC time stamps recording document view, identity verification pass, and signature execution.
• Taxpayer IP address. The Internet Protocol address and device data used during signing.
• User login or identifier. The unique session identifier, account username, or tokenized access code.
• Identity verification result. Proof that the taxpayer passed dynamic KBA with the transaction reference code, or confirmation of in-person verification.
• Tamper-evident cryptographic hash. A SHA-256 hash proving the document was not altered after execution.

How CPA Relay handles Form 8878 and Form 8879 compliance

Rather than treating tax forms like sales contracts or charging per-envelope fees, CPA Relay builds compliance guardrails directly into the Signatures tool:

• Mandatory verification recording. When selecting Form 8878 or Form 8879, CPA Relay disables "No identity verification." You must record whether the client was verified in person or authenticated via third-party KBA. This choice prints permanently on the audit certificate.
• Dual-spouse shared email support. Enter the same email for both spouses. CPA Relay issues two distinct invitations with unique tokens. Each spouse verifies identity and signs independently without secondary email accounts.
• Sanitized PDFs and SHA-256 certificates. CPA Relay strips active scripting from uploaded PDFs and binds the executed document with UTC timestamps, IP addresses, verification methods, and a SHA-256 hash.
• No per-envelope fees. Every CPA Relay seat includes unlimited signature envelopes, with no per-envelope or per-signer fees.

Frequently asked questions about Form 8879 and KBA

Can Form 8879 be signed electronically?
Yes. The IRS permits electronic signatures on Form 8879 and Form 8878, provided the Electronic Return Originator complies with the identity verification, spousal authentication, and audit trail rules in IRS Publication 1345.

What is the difference between in-person ID verification and remote KBA under Publication 1345?
In person, an ERO verifies identity by reviewing a valid government photo ID or by relying on an established multi-year relationship. Remotely, the IRS prohibits unauthenticated signatures and mandates dynamic Knowledge-Based Authentication drawing questions from credit bureaus and public records.

What must a tax preparer do if a client fails KBA three times?
After three consecutive KBA failures, Publication 1345 bars the practitioner from accepting a remote electronic signature for that return. The preparer must obtain a physical handwritten signature on paper or verify identity in person.

How should an ERO handle Form 8879 signatures when spouses share a single email address?
An ERO cannot allow one spouse to sign for both on a shared link. The firm must use software that sends two distinct, tokenized signing invitations to that inbox so each spouse verifies identity and signs independently.