How do I handle eSignatures for users without an email address in an RPA workflow?

All answers to this question.

In these "in-person" signing scenarios, you shift the verification to other factors. Many APIs allow for "SMS Authentication" or "Knowledge-Based Authentication" (KBA). In a project I managed in 2024, we had field techs use a tablet where the client scanned their driver's license. The RPA bot then cross-referenced the ID data with the contract before allowing the signature. The audit trail then records the GPS coordinates of the tablet and the SMS code used, which satisfies the legal requirement for identity verification without needing an inbox.

   Answered 2024-02-10 by Susan Anderson

Multi-factor authentication (MFA) via phone is the standard workaround here. It's actually more secure than email in many cases.

   Answered 2024-09-06 by Dorothy Adams

• I agree with Dorothy. SMS codes are much harder to intercept than a standard email link, making the audit trail even more robust for legal purposes.

     Commented 2024-09-07 by Emily Rodriguez

Does the RPA bot need to be HIPAA compliant if it's handling ID scans and signatures in a medical field-service context?

   Answered 2024-09-08 by Charles Gonzalez

• Charles, absolutely. If the bot touches Protected Health Information (PHI), the entire automation pipeline—including the signature storage—must be encrypted at rest and in transit. You also need a Business Associate Agreement (BAA) with your eSignature provider.

     Commented 2024-09-10 by Richard Scott