Form 8879 electronic signatures: does your identity check hold up?

What does the IRS require before a client e-signs Form 8879?

The IRS allows an electronic signature on Form 8879 only when the return is e-filed through an Electronic Return Originator and the ERO's software verifies the taxpayer's identity first. IRS Publication 1345 sets the bar: identity verification must follow NIST Special Publication 800-63 at Level 2 assurance with knowledge-based authentication, or a higher assurance level.

The publication splits the process by setting. For an in-person signing, the ERO inspects a valid government photo ID, compares the photo to the taxpayer, and records the taxpayer's name, Social Security number, address and date of birth. For a remote signing, where the taxpayer signs and the ERO is not physically present, the ERO records the same four data points and verifies them against record checks with an agency, institution or credit bureau database.

Three details catch firms off guard. The IRS's e-signature FAQs state that identity verification must be completed every time a taxpayer electronically signs Form 8878 or 8879, so a verification from last season does not carry forward. The only exception is an in-person signer with a multi-year relationship with the ERO. And if the taxpayer fails verification after three attempts, the ERO must get a handwritten signature instead.

What has to be in the audit trail?

The signing software has to capture enough to reconstruct who signed, when, and how. Publication 1345 lists the elements, and the ERO must produce them if the IRS asks:

• A digital image of the signed form
• The date and time of the signature
• The taxpayer's IP address and login ID, for remote transactions
• The result of identity verification, or confirmation that a government photo ID was checked for in-person signings
• The signing method used, or an audit trail of the signing

The signed record itself must be tamper-proof. Publication 1345 states that after the electronic record has been signed, it must be tamper-proof, and the storage system needs secure access control and a retrieval system that can produce the record later. EROs keep Forms 8878 and 8879 for three years from the return due date or the IRS received date, whichever is later, and do not send them to the IRS unless requested.

A firm that switches signing vendors, or lets a subscription lapse, can lose access to three years of audit trails that it is still required to keep. Export and index those records before any vendor change.

Why is knowledge-based authentication a weak point?

Knowledge-based authentication asks the signer questions drawn from credit and public records, such as a prior street address or a loan amount. The IRS still accepts it as the floor for Form 8879. NIST has moved away from it. The current revision of NIST's identity proofing guidance, SP 800-63A-4, finalized July 31, 2025, states that knowledge-based verification "SHALL NOT be used for identity verification."

That leaves a gap between the IRS minimum and the standard NIST now applies to federal systems. Publication 1345 still describes the requirement in terms of the older NIST Level 2 language, and KBA continues to satisfy it. The practical concern is that the answers to many KBA questions sit in the same data broker records and breach dumps that identity thieves use. A criminal who already holds a client's Social Security number and address is well placed to pass a quiz built from those records.

Meeting the IRS floor and choosing a stronger method are separate decisions. Some signing platforms offer verification based on a photo of a government ID compared to a live selfie, which aligns more closely with current NIST guidance. Ask your vendor which methods it supports beyond KBA and whether it records the result in a form Publication 1345 accepts.

Where do firms usually get this wrong?

The weak spots tend to be workflow shortcuts, and they multiply during the April crunch. The patterns worth checking:

• Staff completing the signature step for a client who "already approved it" by phone. The taxpayer must sign. Form 8879 lets the taxpayer authorize the ERO to enter or generate the taxpayer's PIN, but that authorization still requires the taxpayer's signature on the form.
• Reusing last year's verification for a remote client. The IRS requires verification at every e-signature.
• Treating a scanned or faxed signature as a remote e-signature. The IRS FAQs state that handwritten signatures returned by mail, fax, email or hand delivery are not remote e-signature transactions. They are still valid signatures, but they follow the handwritten-signature path, not the e-signature rules.
• Shared staff logins on the signing platform. When five preparers use one account, the audit trail shows the account, not the person who sent the request or overrode an error.
• Weak protection on the portal account itself. A signing request that lands in a client portal protected only by a password gives an attacker an easy place to insert a fraudulent return.

How does this connect to your WISP and the FTC Safeguards Rule?

The e-signature workflow is part of the information security program your firm already has to maintain. Publication 1345 reminds tax return preparers that they must create and enact security plans under the FTC Safeguards Rule. That rule requires multi-factor authentication for any individual accessing any information system, under 16 CFR 314.4(c)(5), and that includes staff accounts on your tax software, document portal and signing platform.

Your written information security plan should name the signing platform as a system that holds taxpayer data, describe how identity is verified, and say where the audit trails are stored and for how long. IRS Publication 5708 provides a sample plan you can extend, and our guide to updating your WISP before the 2027 filing season covers the other changes worth making this year.

Publication 1345 also requires providers to report security incidents to the IRS as soon as possible but not later than the next business day after confirming the incident. A compromised signing account that leads to a fraudulent filing falls into that category.

What should you check before the 2027 filing season?

Run through this list with whoever administers your tax and signing software:

• Confirm which identity verification method your signing platform uses for remote Form 8879 signatures, and whether a stronger option than KBA is available.
• Verify the platform records the signed image, date, time, IP address, login ID and verification result for every remote signing.
• Confirm the three-failed-attempts rule routes the client to a handwritten signature rather than letting staff retry indefinitely.
• Pull one signed 8879 from last season and check that you can retrieve the full audit trail in under ten minutes.
• Confirm signed records cannot be edited after signing and are retained for at least three years from the later of the due date or received date.
• Replace shared staff logins with named accounts protected by multi-factor authentication.
• Add the signing platform, its retention period and its export process to your WISP.
• Write down the procedure staff follow when a client says they cannot complete verification, so nobody improvises during the last week of March.

How does s90 help?

s90 manages identity, multi-factor authentication and access controls for tax and accounting firms, and we keep the WISP documentation current as your tools change. If you want a second set of eyes on your e-signature setup before the season starts, we are glad to walk through it with you.