Form 8879 and 8878 e-signatures
This sheet explains how Taxporch captures taxpayer signatures on Form 8879 (IRS e-file Signature Authorization) and Form 8878 (for Form 4868 or 2350 with an electronic funds withdrawal), based on IRS Publication 1345 (Rev. 10-2026). Use it to choose the right signing mode and to answer "what did you record?" if the IRS ever asks.
The three ways a client can sign
| Mode | When to use it | Identity check | What the client does |
|---|---|---|---|
| Remote with KBA | You and the client are not in the same room | Third-party record check with knowledge-based questions, run inside the secure portal | Signs in to the portal, answers the identity questions, reviews the form, signs (typed or drawn) |
| In person | The client is in your office | You inspect a valid government photo ID and attest to it in Taxporch | Signs on your screen or tablet |
| Wet signature | The client prefers paper, or failed KBA three times | None needed for a handwritten form returned to you | Downloads the form, signs by hand, uploads a scan or photo |
Plain e-signatures for engagement letters and other documents don't need KBA. They use the same evidence package without the identity step.
Remote signing with KBA
Publication 1345 describes remote identity verification as a record check against credit-bureau or similar databases that generates knowledge-based questions. In Taxporch:
- You prepare the 8879 in your tax software, save it as a PDF and send it for signature from the client's account.
- The client signs in to the portal (one-time link or password, plus two-step verification if they turned it on).
- Before the questions start, the client sees the advisories Publication 1345 recommends: that a third party checks their identity using records about them, whether this causes a "soft" credit inquiry (which does not affect their credit score), that the IRS never sees their credit report, and that the identity provider never sees their tax return.
- The client enters name, address, date of birth and SSN. These go straight to the identity provider; Taxporch does not store the SSN or the answers.
- The provider asks the questions and returns pass or fail with a transaction reference.
- After three failed attempts, remote signing is locked for that form and the client is asked for a wet signature instead.
- On a pass, the client reviews the full form and signs.
Joint returns: each spouse is a separate signer with their own portal sign-in and their own identity check, as Publication 1345 requires.
Remote KBA needs an identity-verification provider. KBA checks are included in your plan (100 a year on Solo, 300 on Team) and cost $1 each after that.
In-person signing
When the client is physically with you, Publication 1345 asks you to inspect a valid government-issued photo ID, compare the photo, and record the taxpayer's name, SSN, address and date of birth. Taxporch gives you an attestation step: tick that you inspected the ID, note the ID type, and the staff member's name and the time go into the certificate. If you have a multi-year business relationship with the client (you filed for them in a prior year and identified them this way), you can record that instead.
Wet signature upload
A handwritten 8879 that the client returns to you by upload is not a "remote electronic signature" under Publication 1345, so no KBA is needed. The client downloads the form, signs it by hand and uploads a scan or a phone photo. Taxporch files it with the return and logs who uploaded it and when.
What the audit certificate records
Publication 1345 lists the data the software must capture and make available to you in printable form. Every completed signature in Taxporch produces a sealed PDF (the signed form) plus an audit certificate page.
| Required by Publication 1345 | Where it is in Taxporch |
|---|---|
| Digital image of the signed form | The signed PDF: every page rendered as an image with the signature placed on it |
| Date and time of signature | Certificate: timestamps for sent, viewed, consented, identity checked and signed (UTC) |
| Taxpayer's computer IP address (remote) | Certificate: IP address at signing, plus the browser's user agent |
| Taxpayer's login identification (remote) | Certificate: the portal username (email) of the signer |
| Identity verification result | Certificate: KBA pass with provider and transaction reference, or the in-person ID attestation with staff name, or "wet signature" |
| Method used to sign | Certificate: typed name, drawn signature, or handwritten upload, plus the event trail |
The certificate also contains the SHA-256 fingerprint of the original PDF and of the signed PDF, and a seal over the whole event history, so any later change is detectable.
Rules Taxporch enforces
- The signature is tied to one exact PDF. If you upload a new version of the return after the client signed, the old signature no longer counts and the client must sign again.
- Signed records are locked. They can't be edited, and they can't be deleted for at least 3 years (Publication 1345 asks you to keep Forms 8879 and 8878 for 3 years from the return due date or the date the IRS received the return, whichever is later). You can set a longer period.
- Identity checks run only inside the secure portal, never from a link in an email alone.
- ESIGN consent: before a client's first electronic signature, the portal asks them to agree to do business electronically and tells them how to get paper copies and how to withdraw consent.
What stays with you
- Taxporch does not transmit returns. Your tax software does. Make sure your workflow does not transmit a return until the 8879 shows Signed in Taxporch.
- Write the Submission ID on the form or keep the acknowledgment with it, as Publication 1345 requires.
- Don't send 8879s to the IRS unless the IRS asks for them.
- Keep your own procedure in your WISP for which mode you use when.
The NIST question (open)
Publication 1345 says identity verification must follow NIST Special Publication 800-63-4, and at the same time describes knowledge-based questions as the verification method. NIST SP 800-63A-4 says knowledge-based verification shall not be used for identity verification. These two statements conflict. We do not claim that KBA satisfies NIST 800-63-4. We follow the method Publication 1345 describes, keep the wet-signature route available at all times, and will update this page if the IRS clarifies. If this matters for your practice, ask IRS e-help or your own adviser.