How to prove who signed a document

Most e-signature tools let you choose how hard to make it to prove identity, and most people never touch the default setting, which is usually fine for routine contracts and genuinely not enough for higher-stakes ones. Here's how to think about which level actually matches the document in front of you.

Levels of proof, from low to high

Level 1: Email-based tracking. The baseline most e-signature tools provide by default: the signing link is sent to a specific email address, and the audit trail records when it was opened and signed, along with the IP address and timestamp. This proves someone with access to that email account signed, which is a reasonable proxy for identity in most everyday situations, but doesn't independently confirm the signer is actually the person who owns that email address.

Level 2: SMS verification codes. Before signing, the signer receives a one-time code by text message to a phone number you specify, which they enter to proceed. This adds a second, independent channel, meaning someone would need to control both the email account and the specific phone number to complete the signature fraudulently, which is a meaningfully higher bar than email alone. Adding a phone code check before someone signs a high value deal covers the setup.

Level 3: Government ID or video identity verification. The signer is asked to upload a photo of a government-issued ID, sometimes paired with a live selfie or video check, which the platform or a verification service compares against the document. This is the strongest practical level available through most e-signature tools, genuinely proving the specific individual's identity rather than just access to an email or phone number. Checking a person's ID before they sign a lease or sale agreement covers when to use it.

When each level is actually worth it

Level 1 is genuinely enough for the large majority of routine business contracts: standard service agreements, NDAs, vendor terms, purchase orders, especially with counterparties you have an existing relationship with. Adding more verification here is friction without a real benefit.

Level 2 is worth switching on for contracts where the stakes are higher but not extreme: a first-time client signing a meaningful service agreement, a larger purchase order, any situation where you'd genuinely want a stronger answer than "someone with access to that inbox" if the signature were ever questioned.

Level 3 earns its extra friction for the small number of situations where identity really matters and the consequences of getting it wrong are serious: a lease agreement, a property sale or transfer, a large financial commitment, or any transaction where a regulator, lender, or counterparty specifically expects strong identity verification. I'd flag, honestly, that whether a lease or property sale legally requires this specific level of verification (as opposed to it simply being a sensible practice) depends on your jurisdiction and the document type, which is worth confirming with the receiving party or a lawyer rather than assuming either way.

Settings to actually switch on

• Require a specific, named recipient rather than letting the link be forwarded or accessed by anyone with the URL.
• Enable SMS verification for any document above a value or risk threshold you set for your own business, not every single contract.
• Enable ID verification specifically for leases, property transactions, large financial commitments, or anything where you'd genuinely want to prove identity, not just intent to sign, if challenged later.
• Review the audit trail after signing to confirm the verification step you expected actually happened, rather than assuming the setting worked.
• Don't over-apply the strictest setting everywhere. Forcing ID verification on every routine contract adds friction that can genuinely slow down deals that didn't need that level of scrutiny.

The part worth knowing

None of these verification levels change whether a signature is legally valid in the first place, that's governed by the underlying law (the ESIGN Act, UETA, and similar laws covered elsewhere on this site), not by which verification setting you chose. What they change is how strong your evidence is if a signature is ever disputed. A Level 1 signature is still a legally valid signature. It's just a weaker piece of evidence than a Level 2 or Level 3 one would be, in exactly the moment that evidence actually matters. What makes an e-signature valid in court covers the legal side.

A worked example

Say you're a small property manager leasing out three units, two to tenants you've worked with for years and renewed leases with multiple times, and one brand new tenant you've never met in person, found through an online listing. Treating all three leases identically, either all at the basic level or all requiring full ID verification, misses the point. For the two renewal tenants, you already have a strong relationship and history; basic email-based signing is genuinely proportionate. For the brand new tenant you've never met, adding an ID verification step before they sign is a sensible, low-cost way to confirm the person signing the lease is actually who they claim to be, which matters more here precisely because you don't have the relationship history to fall back on if something ever goes wrong.

Matching verification to the relationship, not just the document type

It's tempting to build a simple rule like "always require ID verification for leases" and stop there, but the document type is only half the picture. The other half is how well you actually know the person signing. A long-standing client renewing a familiar contract carries less identity risk than a brand-new counterparty on an identical contract, even though the document itself is the same. I'd treat verification level as a function of both: escalate for higher-stakes document types, and escalate again for unfamiliar counterparties, even on routine documents, rather than treating either factor alone as the complete answer.

What to do if a signer pushes back on extra verification

Occasionally a signer will object to an SMS code or ID check, finding it intrusive or unnecessary, especially if they're used to a simpler process with other businesses. I'd handle this with a short, honest explanation rather than just insisting on the setting: this specific document, because of its value or nature, is one where I want strong proof of who signed, for both of our protection, and the extra step takes less than a minute. Most people accept this readily once they understand it's not about distrust of them specifically, it's a standard practice for this category of document. If someone genuinely refuses and the transaction can't proceed without their cooperation, that's a reasonable moment to reconsider whether the relationship itself, not just the signature, deserves more caution.

A quick self-check for choosing a level

Ask yourself: do I know this signer well, with an established history of dealings? Is the document's value or sensitivity high enough that a dispute would genuinely hurt the business? And does the document type itself, a lease, a large contract, a financial commitment, carry extra weight independent of the relationship? A known counterparty on a routine document needs nothing beyond the basic level. An unfamiliar counterparty on anything meaningful deserves the extra step, even if it adds a minute of friction to the signing process.

How I'd approach this

I size the verification level to the document and the relationship, not to some default setting left unchanged. For routine contracts with known counterparties, I leave it at the basic level and move on. The moment a document is a lease, involves a property transfer, represents a large enough financial commitment, or simply involves someone I don't have an established relationship with, I switch on the stronger verification and tell the client plainly why, because that's the specific moment "probably fine" stops being good enough.

A final practical note

These three levels aren't a ladder you're required to climb in order. Most businesses genuinely spend their whole signing life at Level 1 for routine work, occasionally reaching for Level 2, and rarely touching Level 3 at all. The skill isn't memorizing the levels, it's noticing the specific moment a document's stakes have shifted enough that the default setting stops being good enough, and switching up deliberately rather than by habit. If a signer later denies signing, see what to do when a customer says they never signed the contract.

Frequently asked questions