Practice with national-level exam (FACT, FACT Plus, NET, CUET, etc.) mocks, learn from structured notes, and get your doubts solved in one place.
The high-volume civil and economic-offence casework category every working document lab handles: cheque and demand draft alteration (washed cheques, amount-line alteration, payee substitution, magnetic ink character recognition E-13B integrity), the rubber stamp / embossed seal / dry seal examination workflow (impression depth, ink loading patterns, defect signatures that individualise a specific stamp), the digital seal / scanned-stamp insertion problem on PDFs, and the cross-discipline link to bank fraud and white-collar investigations in India, the US and the UK.
Last updated:
Cheques, demand drafts, and the stamps and seals that authenticate them form the practical backbone of commercial banking and official certification globally, and they constitute the largest single category of questioned-document casework by case volume in India, the United States, and the United Kingdom. Unlike currency counterfeiting, which requires specialist printing equipment and materials, cheque and stamp fraud is accessible to a wider population of offenders because the starting material (a genuine cheque or a legitimate rubber stamp) is readily available, and the alteration or forgery technique can be as simple as a chemical wash, a careful overwriting with a fine pen, or a scanned image inserted into a PDF.
The forensic document examiner approaching cheque and stamp casework operates in a different context from the examiner examining a currency counterfeit. The counterfeit currency examiner typically receives a single note and asks: "Is this genuine?" The cheque examiner typically receives a document that was genuine at some point and asks: "Was this particular field present in its current form when the document was issued, or was it altered after issue?" The distinction matters because it shifts the examination from a binary genuine/counterfeit question to a questioned-alteration question, requiring comparison across multiple elements on the same document, often alongside bank transaction records, the drawer's handwriting exemplars, and the MICR reader logs from the bank's clearing system.
This topic covers the full examination workflow for cheques and DDs, the forensic characterisation of rubber-stamp and seal impressions (and their individualisation to a specific stamp), and the growing challenge of digitally inserted seals on electronic documents.
A genuine cheque is a security-printed document in its own right; understanding what the bank put there before the customer's pen touched it is the starting point for every alteration examination.
A bank-issued cheque in India, the United States, or the United Kingdom is not plain paper with a printed layout: it is a security-printed form manufactured to specifications that include the MICR (Magnetic Ink Character Recognition) encoding line, the substrate, and optional security features incorporated by the bank's cheque printing contractor.
In India, RBI-mandated Cheque Truncation System (CTS-2010) standards require all bank cheques to be printed on 80 gsm paper with specific CTS security features: a watermark of the bank's logo in the substrate; UV-fluorescent printing in the cheque design; void pantograph (a background pattern that reads "VOID" when photocopied or scanned, due to the moiré pattern that emerges when the fine-line pattern is reproduced at a different resolution); and MICR-band printing in E-13B magnetic ink. The MICR line carries the cheque number, sort code (MICR code of the bank branch), and account number, printed in E-13B font (the nine-character font standardised for MICR by the American Bankers Association in 1958 and adopted by RBI for CTS-2010).
In the United States, the ANSI X9.27 standard governs MICR cheque printing. The MICR line is at the bottom of the cheque in E-13B font using magnetic ink (iron oxide-based). It carries the routing transit number (ABA routing number, nine digits), the account number, and the cheque serial number. The Federal Reserve's Regulation CC governs the funds availability and the cheque-clearing timeline, creating the pressure window within which a fraudster must act before a cheque is returned unpaid.
In the UK, Cheque Printing Accreditation Scheme (CPAS) standards (administered by the Cheque and Credit Clearing Company, UK Finance) specify substrate, MICR line (E-13B for standard cheques, CMC-7 font for some applications), and security-feature requirements including UV-reactive inks and void pantograph. Post-2021, the UK has implemented Image Clearing System (ICS) cheque clearing, meaning cheques are cleared by digital image rather than physical presentation; this has forensic implications because the clearing image may capture different information from a physical examination of the original.
The four methods of cheque alteration are chemically, mechanically, optically, and digitally distinct, and each leaves a different forensic signature.
Washed cheques (also called "check washing" in US fraud terminology) involve applying a chemical solvent to the cheque surface to dissolve or lift the written ink entries, leaving the pre-printed bank security printing intact, and then re-writing new entries. The solvents typically used (acetone, bleach, various proprietary correction fluid solvents) attack the ink binders of standard ballpoint and fountain pen inks. The forensic signature of washing includes: dissolution halos in the paper substrate visible under transmitted light or oblique raking light (the solvent spreads laterally beyond the ink area, creating a tide-mark in the substrate); UV fluorescence anomaly at the treated area (the UV-reactive security ink may be partially affected, or the substrate fluorescence is altered by the solvent); ESDA (Electrostatic Detection Apparatus) anomaly where the original writing left an electrostatic impression in the paper that survives the chemical treatment and is visible under the ESDA process; and, most reliably, fibre disruption in the substrate visible under a stereo microscope (the solvent loosens and lifts paper fibres, producing a more porous and lofted surface texture in the treated area compared to untreated areas of the same cheque).
Amount-line alteration without chemical washing is performed by mechanical overwriting: adding digits to the amount in figures (turning "1000" to "11000" by inserting a leading "1"), inserting additional words in the amount-in-words line (adding "and fifty thousand" to "one lakh"), or altering specific digits by overwriting (turning "3" to "8" by adding pen strokes). The forensic examination focuses on: ink stroke layering (added strokes sit above original strokes and, in favourable cases, show different ink chemistry under VSC multispectral examination); pen pressure profile (added strokes may show different paper indentation depth from the original, detectable by ESDA or atomic force microscopy); and letter formation consistency (in handwritten amounts, a forger's formed letters differ in pen-lift pattern and letter-proportion from the original drawer's formed letters, detectable by handwriting comparison).
Payee-name substitution involves erasing or altering the payee field. Mechanical erasure (rubber eraser) leaves fibre disruption and removed surface glaze detectable under oblique light. Chemical erasure leaves a dissolution halo and UV anomaly. In the digital context, a payee line can be altered by scanning the cheque, editing the image, and printing a new version on plain paper (which fails the CTS-2010 security feature checks during electronic clearing) or on cheque-format paper (more sophisticated).
Intercept fraud (a variant not requiring alteration) involves intercepting a cheque in postal or internal mail and endorsing it to the fraudster, who presents it at a different branch or institution. This is a chain-of-custody crime rather than a document forgery crime, but the forensic examiner may be asked to authenticate the endorsement signature.
The MICR line is the one element of a cheque that a document forger cannot hand-write; if the MICR line is wrong, the cheque has been physically replaced or the MICR has been overprinted.
The MICR E-13B font consists of fourteen characters (digits 0-9 plus four special symbols: transit, amount, on-us, and dash) designed for machine recognition by magnetic read heads at specific spatial frequencies. The characters have distinctive shapes with flat horizontal elements optimised for MICR reader signal discrimination; the E-13B shape vocabulary is immediately visually distinguishable from any standard typeface by a trained examiner. Genuine MICR printing uses iron-oxide-based magnetic ink printed by high-precision printer systems with character placement tolerances of ±0.1 mm specified under ANSI X9.27.
Forensic examination of MICR E-13B characters begins with visual inspection under a stereo microscope at 10x to 40x: genuine MICR characters show consistent ink density, sharp character edges with no feathering, and consistent spatial metrics (character width, inter-character gap, line height) across the full MICR line. A fraudulently overprinted MICR line (where the original MICR line has been covered with correction fluid or a paper strip and a new MICR line printed over it) shows: a physical step at the cover material boundary visible under raking light; ink-density inconsistency at the overprint boundary; possible MICR-character metric deviations from the original; and, most diagnostically, the original MICR characters visible through the cover material under IR transmitted light (many correction materials are IR-transparent).
An MICR reader test on the suspect cheque (passing it through a standard MICR reader, available at forensic laboratories and at bank clearing departments) verifies the magnetic response of the MICR line. Genuine iron-oxide magnetic ink produces a specific signal waveform per character; an inkjet-printed simulation of MICR characters using standard (non-magnetic) inkjet ink produces no magnetic signal, immediately identifying the MICR line as false. Some laser toners contain sufficient iron oxide to produce a marginal magnetic signal but not at the correct amplitude for reliable reader recognition, resulting in read errors that are also forensically diagnostic.
In India, NPCI (National Payments Corporation of India) specifies MICR quality standards for CTS-2010 clearing; cheques with MICR errors are returned unpaid with a specific return code (reason code 29 or 38 for MICR defect). In the US, the Federal Reserve's MICR quality requirements under Regulation CC provide the compliance benchmark. In the UK, UK Finance's CPAS specifications govern MICR quality for cheque images submitted under the Image Clearing System.
Every rubber-stamp in use long enough to appear in casework has a defect signature, and that signature is more individualising than the text it prints.
A rubber stamp produces an impression through three physical mechanisms: the elastomeric rubber die, which carries the raised design; the ink pad or self-inking mechanism, which delivers ink to the raised elements; and the substrate pressure, which transfers the ink. Each of these mechanisms contributes to a forensic signature.
The rubber die accumulates defects through use: nicks from hard foreign objects pressing into the die face; areas of compression where repeated stamping has flattened raised elements; rubber fatigue cracks that produce characteristic fine lines across the impressed design; and edge degradation where the outer border of the stamp impression becomes ragged from die-face wear. These defects are specific to a particular physical stamp (not to the manufacturer or model) and change slowly over time. A sufficient collection of exemplar impressions from the same stamp, produced before and after the questioned impression, allows the examiner to place the questioned impression within the temporal sequence and to individualise it to the specific die.
Ink-loading pattern examination assesses the distribution of ink across the impression. A correctly inked stamp shows consistent density across raised elements. An over-inked stamp shows ink flooding into the counters (the recesses of the die face between raised elements), producing "filling" of fine-line elements and ring-like halos at character edges. An under-inked stamp shows voids in the impression (areas of insufficient ink transfer), often at the die-face centre where ink is depleted first. These loading patterns are consistent for a given stamp and pad combination and must be reproduced by an exemplar impression made with the same stamp and pad to constitute a meaningful comparison.
The forensic examination workflow for a questioned rubber-stamp impression begins with low-power stereo microscopy (10x to 20x) to assess: character formation (are the letterforms consistent with the nominal die design, or has die deformation altered character shapes?); ink-edge profile (sharp edges from a clean rubber die; ragged edges from a worn die); defect inventory (catalogue every nick, void, and crack in the questioned impression); and alignment and spacing (does the text alignment match the die specification, or has the die substrate delaminated, causing individual type elements to shift?). The defect inventory from the questioned impression is then compared against exemplar impressions from the suspect stamp.
In cases where no physical stamp is available for exemplar production, the questioned impression is compared against a reference database of known-genuine impressions for that institution's stamp design series. Official stamps (court seals, government agency stamps, notary public seals) are typically registered with the issuing authority, and reference impressions can be obtained through a formal request.
An embossed seal leaves a three-dimensional signature in the substrate that cannot be replicated by a flat printing process, but its individualisation depends on the press geometry and the substrate's deformation response.
Embossed seals (also called wet-embossed seals or raised seals) and dry seals produce impressions by pressing a two-part metal die (a male die and a female counter-matrix) into the substrate under mechanical pressure, deforming the paper fibres without ink. The resulting impression is a three-dimensional relief: the male die produces the raised elements on one face; the female counter-matrix produces corresponding recesses on the reverse face.
Forensic examination of embossed seals begins with stereo microscopic examination of the relief profile. The depth and uniformity of the relief indicate pressing pressure: a well-struck genuine seal on appropriate paper shows consistent relief depth across all design elements. Shallow or partial relief (some elements clear, others barely raised) suggests either: pressing pressure below the design specification; a seal not properly centred in the press jaws; or a photomechanical simulation (a flat-printed or photocopied impression without three-dimensional relief).
Transmitted-light examination of an embossed seal impression distinguishes genuine embossing from a flat photocopy: under transmitted light, the compressed paper fibres at embossed elements appear slightly darker (fibres are denser in the compressed zone), and the overall impression shows a shadow gradient at element edges that is absent from a flat-printed simulation. Confocal microscopy and 3-D surface profilometry can quantify the relief depth profile and establish whether the impression is consistent with genuine embossing pressure for the claimed seal type.
The counter-matrix (the female die) is specific to its companion male die: scratches, tool marks, and manufacturing imperfections on the counter-matrix transfer as positive elements in the impression (ridges in the counter-matrix become voids in the paper, visible under oblique raking light). These counter-matrix marks are as individualising as rubber-stamp defects and serve the same forensic function.
In Indian legal proceedings, court seals and government registration department seals are frequently questioned. The Stamps Act 1899 (still operative in India for stamping requirements) and the Indian Registration Act 1908 create an institutional framework for seal use; forensic examination of questioned seals under these instruments is governed by the expert-evidence provisions of the Bharatiya Sakshya Adhiniyam 2023 (BSA 2023, Section 45). In the UK, the Companies Act 2006 governs company seals; the Land Registration Act 2002 governs conveyancing seals. Questioned seal evidence in English law is admitted under the expert-opinion framework established in cases including R v. Robb [1991] 93 Cr App R 161 (admissibility of forensic expertise evidence generally) and the CPR Part 35 expert-witness code.
The migration of official documents to PDF has created a new category of seal fraud that is invisible to the naked eye and requires digital forensic examination rather than physical examination.
As official documents (contracts, certificates, conveyancing documents, government orders, company communications) have migrated from physical to electronic form, the forgery of stamps and seals has migrated alongside them. A digitally inserted seal on a PDF is typically an image file (PNG or JPEG) of a genuine seal impression, either scanned directly or composited from multiple scan sources, inserted into a PDF document at the position where a genuine seal would appear. The forged document, when printed and examined physically, may show a convincing seal impression; when the PDF is examined digitally, multiple forensic indicators distinguish the inserted image from an electronically signed document with a genuine digital seal.
PDF metadata examination is the first step. A genuine digitally executed document carries consistent creation metadata: the PDF's CreateDate and ModDate fields, the producer application, and the document's modification history (preserved in the XMP metadata block for PDF/A documents). A document that claims to be executed on a specific date but whose PDF metadata shows a creation date after that claimed date, or whose modification history shows the document was opened and re-saved after the claimed execution date, is a forensic indicator of backdated forgery.
Font and image-compression analysis distinguishes scanned content from natively created content. A PDF generated directly from a word processor (Microsoft Word, LibreOffice, Google Docs) embeds vector text with specific font metrics; a scan of a printed page produces rasterised text at the scanner DPI. A document claiming to be a native word-processor output but containing rasterised text is either a scan of a printed page or a fabrication. Conversely, a document claimed to be a physical original subsequently scanned but containing vector-embedded fonts and selectively rasterised image elements (the seal image in PNG format, the text in vector type) has been assembled digitally from multiple components and is not a scan of a single physical original.
The seal image itself is amenable to error-level analysis (ELA): a technique that compares the JPEG compression artefact levels across different regions of a JPEG image. In a uniformly scanned document, all regions show similar compression artefact levels from the single JPEG save event. A composited document shows higher ELA residuals at the inserted seal image boundary relative to the surrounding document, because the seal image was JPEG-compressed independently before insertion and then re-compressed as part of the document JPEG save, leaving a "double-compression" signature at its boundary.
Electronic Digital Signatures (EDS) under India's Information Technology Act 2000 (amended 2008) and the PKI framework of the Controller of Certifying Authorities (CCA) provide a cryptographic alternative to physical seals: a document signed with a DSC (Digital Signature Certificate) issued by a CCA-licensed CA carries a cryptographic hash verifiable against the signer's public certificate. An electronically signed PDF with a DSC-based signature can be verified using Adobe Acrobat's signature verification or open-source tools such as VeraPDF; a tampered document fails the signature verification. In the UK, electronic signatures under the Electronic Identification and Trust Services (eIDAS) Regulation (now domesticated as UK eIDAS post-Brexit) provide a similar framework. US e-signatures under ESIGN Act (2000) and UETA (1999) create a similar electronic-record validity framework.
| Examination type | Physical seal/stamp | Scanned/digitally inserted seal | Electronically signed document |
|---|---|---|---|
| Primary examination tool | Stereo microscope, transmitted light, raking light | PDF metadata analysis, ELA, font/image analysis | Digital signature verification (PKI chain) |
| Individualisation method | Defect inventory comparison against exemplars | Image provenance analysis, source document comparison | Certificate chain to issuing CA and signer identity |
| Fabrication failure mode | Missing 3D relief; wrong defect profile; ink chemistry mismatch | Metadata date inconsistency; ELA boundary artefact; double-compression | Signature chain broken; tampered document fails hash verification |
| Legal instrument (India) |
A forensic examiner uses ESDA on a cheque suspected of chemical washing to remove the original payee name. The ESDA reveals the impression of a name different from the current payee name written on the cheque. What does this finding indicate?
Test yourself on Questioned Document with free, timed mocks.
Practice Questioned Document questions| BSA 2023 Section 45 expert evidence |
| IT Act 2000 s.65B electronic evidence |
| IT Act 2000 s.3A digital signatures; CCA rules |
| Legal instrument (UK) | CPR Part 35 expert opinion | Civil Evidence Act 1995; PACE 1984 s.69 | UK eIDAS; Electronic Communications Act 2000 |
| Legal instrument (US) | FRE 702 expert testimony; Daubert standard | FRE 1001-1004 (best evidence); Fed. R. Evid. 901(b)(9) | ESIGN Act 2000; UETA 1999 |