User Guide Cancel

Government ID authentication

Last updated on

Adobe Acrobat Sign Guide

What's New

Get Started

Administer

Admin Console Overview
User Management
1. Add a User
2. Add Users in Bulk
3. Add Users from your Directory
4. Add Users from MS Azure Active Directory
5. Check for users with provisioning errors
6. Change Name/Email Address
7. Edit a user's group membership
8. Edit a user's group membership through the group interface
9. Promote a user to an admin role
10. User Identity Types and SSO
11. Switch User Identity
12. Authenticate Users with MS Azure
13. Authenticate Users with Google Federation
14. Product Profiles
15. Login Experience
Account/Group Settings
1. Settings Overview
2. Global Settings
  1. Account tier and ID
  2. Self Signing Workflows
  3. Send in Bulk
  4. Web Forms
  5. Custom Send Workflows
  6. Power Automate Workflows
  7. Library Documents
  8. Collect form data with agreements
  9. Limited Document Visibility
  10. Attach a PDF copy of the signed agreement
  11. Include a link in the email
  12. Include an image in the email
  13. Files attached to email will be named as
  14. Attach audit reports to documents
  15. Merge multiple documents into one
  16. Upload a signed document
  17. Delegation for users in my account
  18. Allow external recipients to delegate
  19. Authority to sign
  20. Authority to send
  21. Power to add Electronic Seals
  22. Set a default time zone
  23. Set a default date format
  24. Users in Multiple Groups (UMG)
    1. Upgrade to use UMG
  25. Group Administrator Permissions
  26. Replace recipient
  27. Audit Report
    1. Overview
    2. Allow unauthenticated access on the transaction verification page
    3. Include reminders
    4. Include view events
    5. Include agreement page/attachment count
  28. In Product Messaging and Guidance
  29. Accessible PDFs
  30. New authoring experience
  31. Healthcare customer
3. Account Setup
  1. Add logo
  2. Customize company Hostname/URL
  3. Add company name
4. Signature Preferences
  1. Well formatted signatures
  2. Allow recipients to sign by
  3. Signers can change their name
  4. Allow recipients to use their saved signature
  5. Custom Terms of Use and Consumer Disclosure
  6. Navigate recipients through form fields
  7. Decline to sign
  8. Allow Stamps workflows
  9. Require signers to provide their Title or Company
  10. Allow signers to print and place a written signature
  11. Show messages when e-signing
  12. Require signers to use a mobile device to create their signature
  13. Request IP address from signers
  14. Exclude company name and title from participation stamps
5. Digital Signatures
  1. Overview
  2. Download and sign with Acrobat
  3. Sign with Cloud Signatures
  4. Restricted Cloud Signatures Providers
6. Electronic Seals
7. Digital Identity
8. Report Settings
  1. New report experience
  2. Classic report settings
9. Security Settings
  1. Single Sign-on settings
  2. Remember-me settings
  3. Login password policy
  4. Login password strength
  5. Web session duration
  6. PDF encryption type
  7. API
  8. User and group info access
  9. Allowed IP Ranges
  10. Account Sharing
  11. Account sharing permissions
  12. Agreement sharing controls
  13. Signer identity verification
  14. Agreement signing password
  15. Document password strength
  16. Block signers by Geolocation
  17. Phone Authentication
  18. Knowledge-Based Authentication (KBA)
  19. Allow page extraction
  20. Document link expiration
  21. Upload a client certificate for webhooks/callbacks
  22. Timestamp
10. Send settings
  1. Show Send page after login
  2. Require recipient name when sending
  3. Lock name values for known users
  4. Allowed recipient roles
  5. Recipient groups
  6. Required fields
  7. Attaching documents
  8. Modify Agreements
  9. Agreement name
  10. Languages
  11. Private messages
  12. Allowed signature types
  13. Reminders
  14. Signed document password protection
  15. Signer identification options
    1. Overview
    2. Signing password
    3. One-Time Password via Email
    4. Acrobat Sign authentication
    5. Phone authentication
    6. Cloud-based digital signature
    7. Knowledge-based authentication
    8. Government ID
    9. Signer Identity reports
  16. Content Protection
  17. Enable Notarize transactions
  18. Document Expiration
  19. Preview, position signatures, and add fields
  20. Signing order
  21. Liquid mode
  22. Custom workflow controls
  23. Upload options for the e-sign page
  24. Post-sign confirmation URL redirect
11. Message Templates
12. Bio-Pharma Settings
  1. Overview
  2. Enforce identity authentication
  3. Signing reasons
13. Workflow Integration
14. Notarization Settings
15. Payments Integration
16. Signer Messaging
17. SAML Settings
  1. SAML Configuration
  2. Install Microsoft Active Directory Federation Service
  3. Install Okta
  4. Install OneLogin
  5. Install Oracle Identity Federation
18. Data Governance
19. Time Stamp Settings
20. External Archive
21. Account Languages
22. Email Settings
  1. Email header/footer images
  2. Permit individual user email footers
  3. Customize the Signature Requested email
  4. Customize the To and CC fields
  5. Custom email templates
23. Migrating from echosign.com to adobesign.com
24. Configure Options for Recipients
Guidance for regulatory requirements
1. Accessibility
2. GDPR
3. 21 CFR part 11 and EudraLex Annex 11
4. Healthcare customers
5. IVES support
6. eOriginal vaulting for chattel paper
7. EU/UK considerations
Download Agreements in Bulk
Claim your domain

Send, Sign, and Manage Agreements

Send Agreements
Authoring fields into documents
1. In-app authoring environment
2. Create forms with text tags
3. Create forms using Acrobat (AcroForms)
  1. AcroForm creation
  2. Creating accessible PDFs
4. Fields
  1. Field types
  2. Field content appearance
  3. Field validations
  4. Masked fields values
  5. Setting show/hide conditions
  6. Calculated fields

Authoring FAQ
Sign Agreements
Manage Agreements
Audit Report
Reporting and Data exports
1. Overview
2. Grant users access to reporting
3. Report charts
4. Data Exports
5. Rename a report/export
6. Duplicate a report/export
7. Schedule a report/export
8. Delete a report/export
9. Check Transaction Usage

Advanced Agreement Capabilities and Workflows

Webforms
Reusable Templates (Library templates)
Transfer ownership of web forms and library templates
Power Automate Workflows
1. Overview of the Power Automate integration and included entitlements
2. Enable the Power Automate integration
3. Track Power Automate usage
4. Create a new flow (Examples)
5. Triggers used for flows
6. Importing flows from outside Acrobat Sign
7. Manage flows
8. Edit flows
9. Share flows
10. Disable or Enable flows
11. Delete flows
12. Useful Templates
  1. Administrator only
  2. Agreement archival
    1. Save your completed documents to SharePoint
    2. Save your completed documents to One Drive for Business
    3. Save your completed documents to Google Drive
    4. Save your completed documents to DropBox
    5. Save your completed documents to Box
  3. Webform agreement archival
    1. Save completed web form documents to SharePoint Library
    2. Save completed web form documents to OneDrive for Business
    3. Save completed documents to Google Drive
    4. Save completed web form documents to Box
  4. Agreement data extraction
    1. Extract form field data from your signed document and update Excel sheet
  5. Agreement notifications
    1. Send custom email notifications with your agreement contents and signed agreement
    2. Get your Adobe Acrobat Sign notifications in a Teams Channel
    3. Get your Adobe Acrobat Sign notifications in Slack
    4. Get your Adobe Acrobat Sign notifications in Webex
  6. Agreement generation
    1. Generate document from Power App form and Word template, send for signature
    2. Generate agreement from Word template in OneDrive, and get signature
    3. Generate agreement for selected Excel row, send for review and signature
Custom Send workflows
Share users and agreements
1. Share a user
2. Share agreements

Integrate with other products

Acrobat Sign Developer

REST APIs
Webhooks

Overview

Powered by advanced machine learning algorithms, Adobe Acrobat Sign’s Government ID process empowers companies across the globe with the ability to secure a high-quality authentication of their recipient's identity.

Government ID is a premium identity authentication method that instructs the recipient to upload the image of a government-issued identity document (driver’s license, national ID, passport), and then evaluates that document for authenticity.

Supported documents include:

Global Passport
- All ICAO-compliant passport books
Driver license / National ID / Residence Permits

Country	Driver's License	Identification Card	Residence Permit
Australia	Supported
Austria	Supported	Supported
Belgium	Supported	Supported	Supported
Bulgaria		Supported
Canada	Supported	Supported
Croatia		Supported
Czech Republic		Supported
France	Supported	Supported	Supported
Germany	Supported	Supported	Supported
Hungary		Supported
Ireland	Supported
Italy	Supported	Supported
Latvia		Supported
Lithuania		Supported
Malta		Supported
Mexico		Supported
Netherlands	Supported	Supported	Supported
New Zealand	Supported
Poland	Supported	Supported
Portugal	Supported	Supported
Romania	Supported	Supported
Slovakia		Supported
Spain	Supported	Supported	Supported
Sweden	Supported
Switzerland	Supported	Supported
United Kingdom	Supported		Supported
United States of America	Supported	Supported

The service evaluates the document image for authenticity by validating dozens of elements within the document, including:

Document structure
Biographical data
PDF417 barcode (if applicable)
Machine-readable zone (if applicable)
Security features
Photo zone
Signature

Biometric comparison: In addition to the document verification, an optional biometric comparison can be enabled upon request. The biometric comparison guides the recipient to take a real-time image (a "selfie") and then evaluates that image relative to the image on the uploaded document. The biometric comparison requires the recipient to respond to on-screen prompts to display "liveness", ensuring previously taken static images are not used.

Recipients are first made aware of the agreement via an email notification which contains a Review and sign button to access the agreement contents:

When the Review and sign button is clicked, the authentication challenge is triggered.
The recipient is prompted to provide a phone for a smartphone that can accept text messages,

This is required for the image capturing application that compares the ID document to the government database.
- There is a 15-minute time limit to complete the verification process that starts once the email link is clicked.
- Once the text message is sent, a blue message appears indicating the message is sent, and the link in that message has a five-minute expiration.
Note:

If the signature process is started on a smartphone, this phone number step is skipped.
A text message is delivered to the provided phone number with a link to the ID service.

Once the link is clicked, the recipient is given the option to authenticate with either a Driver's License / ID card or a Passport.

Note:

During the process of gathering and verifying the document content, the original notification page displays a status message that the details are being verified:
When using a driver's license or ID card the app prompts the recipient to take an image of:
- The front of the card
- The back of the card
- Themselves (Optional based on account configurations)
If using a Passport, only one image of the passport is required.
Optional real-time self-image for biometric comparison to the document image.

If the real-time "selfie" option is enabled for the account, the recipient is instructed to perform some live action to demonstrate that the recipient is real and reacting to the prompts of the image capture application.

When the "liveness" test is passed, the app captures the image and performs the biometric comparison to the identity document's image.
Once the identity is successfully verified, the recipient is granted access to the agreement and can complete their actions on the original device where the email was opened.
- The name of the recipient as presented on the ID is imported to the signature field and can not be edited
The recipient has five attempts to verify their ID successfully. If they all fail five attempts, the agreement is canceled, and the sender is notified.

Layer 1 - Document validation:

The first layer of technology provides a seamless and secure method to validate an identity document presented in a digital transaction; ensuring that the document is genuine and unaltered.

Combining a best-in-class capture experience with a proven ID document verification engine ensures trusted digital identity proofing with a seamless user experience.

Government ID verification is available for all Latin-based languages and supports thousands of international and domestic identity documents, including:

Passports
ID Cards
Driver’s Licenses

To achieve reliable results, the service delivers each of the following:

Guided document capture - Users are instructed how to take a quality photo for optimal processing
Document classification – “Computer vision” algorithms recognize and classify thousands of government-issued documents, allowing for reliable data extraction and document validation
Data extraction - Going beyond simple optical character recognition, this service deconstructs the document and analyzes the content of each field
Evaluation of authenticity elements - A combination of artificial intelligence techniques validate dozens of elements within the identity document, including:
- Document structure - Physical attributes of the ID document are evaluated for correct size, material, shape, color, layout, etc.
- Biographical data - Printed data that identifies the individual is evaluated for font usage, color, acceptable values, etc.
- PDF417 barcode (if applicable) - OCR results of the biodata from the front are compared with the data extracted from the PDF417 barcode at the back
- Machine-readable zone (if applicable) - The Machine Readable Zone (MRZ) printed area is checked for font usage, presence, check digits, etc.
- Security features - Both visual and invisible security features of the ID are checked for presence, position, content, etc.
- Photo zone - Portrait, or main picture, is evaluated for having a human face, orientation, color, etc.
- Signature - The signature section is checked for presence, font type, matching with known samples, etc.

Layer 2 - Biometric comparison:

The second layer of authentication matches the portrait extracted from the ID document with a "selfie" from the user through a biometric facial comparison; affirming that the user submitting the ID document is its rightful owner.

Anti-spoofing techniques

Video frame analysis is used to ensure the user can take a quality selfie in optimal capture conditions
During the process of capturing the selfie, the recipient is instructed to perform an action (e.g.: Smile!) to demonstrate "liveness"
Lighting, focus, and alignment are some of the conditions evaluated

Once the recipient's identity is verified, the agreement is opened for review and available for any actions assigned to the recipient (e.g., form filling, signatures).

Note:

The Government ID authentication method is available to the enterprise service plan only but is not available for accounts purchased via the VIP program.

Configuring the Government ID authentication method when composing a new agreement

When Government ID is enabled, the sender can select it from the Authentication drop-down just to the right of the recipient's email address.

If Government ID isn't on the list, then Government ID isn't enabled for the group that the user is sending the agreement from, and an admin will have to enable it.

Consumption of premium authentication transactions

Government ID authentication is a premium authentication method that has a per-recipient charge.

Government ID transactions must be purchased and installed before the option can be used.
Government ID transactions are consumed per recipient configured with the Government ID authentication method.
- One agreement configured with three recipients, two of which authenticate with Government ID, consumes two authentication transactions.
Authentication transactions are deducted from the account total when the agreement is sent to authoring (as a draft agreement) or sent to the first recipient (as an in-progress agreement).
- Canceling a draft agreement refunds the authentication transactions to the account's total.
- Canceling an in-progress agreement does not refund any authentication transactions.
- Changing an existing authentication method to Government ID consumes one license.
- Changing the authentication method from Government ID does not refund the authentication transaction.
  - Changing the authentication back and forth with Government ID only ever consumes one transaction (for any given recipient).

Signer Identity Report (SIR)

Acrobat Sign does not retain the identity information gathered during a Government ID authentication by default. However, account-level admins can request to store the identity information in the Acrobat Sign system via the Signer Identity Report (SIR).

The SIR contains data collected during Government ID verification (e.g., signers’ Government ID image, face image, phone number, data extracted from Government ID, etc.).

The SIR:

persists alongside the audit report
can be accessed by the Sender using the Manage page interface or a v6 REST API call
can be destroyed through the same data governance or GDPR delete actions that delete the audit report

More information on the SIR can be found here >

Audit Report

The audit report clearly indicates that the recipient's identity was verified with a Government ID authentication:

If the agreement is canceled due to the recipient being unable to authenticate, the reason is explicitly stated.

Failed authentication in the audit report

Best Practices and Considerations

If second-factor signature authentication isn't required for your internal signatures, consider using the Acrobat Sign Authentication method instead of Government ID to reduce the friction of signing and save on the consumption of the premium authentication transactions
Government ID: (i) is not intended for regulated or high-value electronic signature workflows and use cases; (ii) cannot identify all fraudulent or “fake” identification documents; and (iii) may not replace the need for human review

Configuration Options

Enable the authentication method under Send Settings

Access to Government ID authentication requires that a contract is in place for an annual volume of recipients. Until this is configured on the back end, the option is not visible in the administrator's interface.

Once the purchase of the identity transactions has been entered into the system, admins will find the controls for exposing Government ID authentication on the Send Settings page with the other identity authentication methods .

Enable the method by checking the Government ID authentication box.

Once the method is enabled, the admin will have the option to set Government ID authentication as the default value for new agreements. The option is not visible until the method is explicitly enabled:

Optional "Selfie" biometric comparison

Customers that would like to include the biometric comparison between the identity document and a real-time selfie of the recipient can contact the support team to have the feature enabled.

Automatic agreement cancelation when a recipient fails to authenticate

The Government ID service is configured to allow up to four consecutive failed attempts to authenticate the recipient's identity. After the fifth failure, the agreement is automatically canceled in the system, and the agreement owner is notified of the agreement being canceled due to an authentication failure.

The option to configure this threshold is not in the customer-facing interface. Account admins can request that the cancelation threshold be adjusted to another value through the support team.