Remote Online Notarization (RON) state regulations and identity assurance frameworks require strict safeguards around identity proofing. NotaryCentral enforces automated attempt policies for Knowledge-Based Authentication (KBA) and Government ID Verification with Biometrics (Document & Selfie). Here is how retry limits, lockout periods, notary controls, and technical error handling operate across the platform.
ID & Biometrics (3 Attempts)
Signers receive up to 3 substantive attempts for government ID verification and selfie matching. Reaching 3 failures activates a mandatory 24-hour lockout.
KBA Personal History (2 Attempts)
Signers receive 1 initial quiz plus 1 retry quiz (2 total attempts). Failing both quizzes triggers a 24-hour lockout.
Notary Retry Controls
Notaries can allow signers to retry after initial failures, but cannot bypass an active 24-hour lockout once maximum attempts are reached.
1. ID Verification & Biometrics Retry Rules
Government ID verification and biometric liveness checks (credential analysis) confirm that a signer possesses a valid, unexpired government document and matches the document's photo.
Attempt Limits & Lockout Policy
- Attempt Limit: A signer is permitted up to 3 substantive verification attempts per workspace identity scope.
- Substantive Failures: An attempt is consumed whenever a verification check finishes with a document or selfie rejection (such as unverified document image, expired document, data mismatch, selfie face mismatch, or liveness failure).
- 24-Hour Lockout: Upon reaching 3 failed attempts, NotaryCentral automatically locks identity verification for 24 hours (
lockedUntil = +24h).
Notary Controls & Reset Boundaries
- Interim Retries (Attempts 1 & 2): If a signer fails their 1st or 2nd ID verification attempt, their status is placed in a disabled review state. The notary can review the session and click "Allow Signer to Try Again" to clear the disabled state and grant a retry.
- Maximum Lockout Protection (Attempt 3): Once the 3-attempt threshold is reached and the 24-hour lock is activated, the notary cannot override or bypass the lockout. The backend policy engine enforces the 24-hour waiting period to satisfy RON compliance regulations.
2. Knowledge-Based Authentication (KBA) Retry Rules
Knowledge-Based Authentication requires signers to answer dynamic multiple-choice questions derived from public records and personal credit history data.
Attempt Limits & Quiz Structure
- Attempt Limit: Up to 2 quiz sessions (1 initial session + 1 retry session).
- Quiz Format: Each quiz consists of 5 multiple-choice questions.
- Time Limit: Signers have 2 minutes (120 seconds) to complete all 5 questions.
- Passing Score: Signers must answer at least 4 out of 5 questions correctly (80%) to pass.
KBA Retry Flow & Lockout Rules
- 1st Attempt Failure: If a signer fails the first KBA quiz or lets the 2-minute timer expire, they are offered 1 retry attempt with a newly generated set of questions.
- 2nd Attempt Failure: If the signer fails the retry quiz, KBA is marked as failed.
- 24-Hour Lockout: Failing both KBA attempts automatically locks identity verification for 24 hours. Notaries cannot override a KBA lockout during the active 24-hour lock period.
3. Technical Errors vs. Substantive Failures
NotaryCentral distinguishes between user verification failures and system/network issues:
- Substantive Failures (Consumes Attempt): Incorrect KBA answers, blurry/unreadable ID uploads, expired IDs, photo mismatches, or failed selfie liveness checks. These count toward the signer's attempt limit.
- Technical Errors (Does NOT Consume Attempt): Temporary network drops, browser session timeouts (
session_error), API rate limits (rate_limited), or unsupported camera devices (device_unsupported). Technical failures abandon the session cleanly without incrementing the failure count, allowing the signer to restart immediately.
4. Real-Time UI Synchronization & Safety
To prevent accidental re-attempts or transient button clicks during verification sync:
- Real-Time Handshake: Verification status updates are broadcast via WebSockets in real time across the signer interface and notary dashboard.
- Synchronized Loading Guards: Whenever requirement details are re-syncing (such as after an ID failure or tab focus), the "Launch Verification" button displays an active loading spinner and remains disabled until policy checks complete.
- Clear Signer Messaging: If a signer is locked out, the interface clearly displays: "Your identity verification is currently locked for 24 hours because maximum attempts were exceeded." along with the exact time the lock expires.