Skip to content

Signature Examination: Genuine, Simulated, Traced and Auto-Forgery

The full spectrum of signature problems the examiner sees: genuine signatures and their natural variation, freehand simulation (the practised forger working from a model), traced signatures (carbon transfer, indented tracing, light-box tracing, transmitted-light tracing, modern digital projection), auto-forgery (the writer simulating their own signature to later disavow), computer-generated signature images cut-and-pasted into PDFs, the diagnostic features that separate each class (line quality, pen lifts, tremor, ink pooling, pressure pattern) and the case studies that built the modern signature literature.

Last updated:

Share

Forensic document examiners classify signature forgeries into four types: freehand simulation, traced (via carbon transfer, indentation, light-box, or digital projection), auto-forgery, and computer-generated image substitution. Each type produces a distinct physical and dynamic evidence profile, so the examination strategy and instrumental techniques differ for each. Freehand simulation is exposed by reduced pen speed, irregular tremor, and retouching; tracing by transfer residue or indentation; auto-forgery only by document-dating and ink-dating techniques, never by handwriting comparison alone. The benchmark standard for any comparison is a minimum of 20 to 30 genuine exemplars spanning varied dates and conditions, as specified in SWGDOC and ENFSI guidelines.

A signature is a motorically ingrained movement pattern rehearsed across years until it runs automatically. Forensic examiners classify forgeries into four types: freehand simulation, traced (carbon, indented, light-box, or digital projection), auto-forgery, and computer-generated image substitution. Each type demands a different examination strategy because each leaves a different physical evidence profile.

Key takeaways

  • Freehand simulation produces reduced pen speed, irregular tremor, and retouch marks because the forger draws rather than signs.
  • Indented tracing leaves physical deformations in the paper detectable by ESDA (Electrostatic Detection Apparatus), even when no carbon residue is present.
  • Auto-forgery is undetectable by handwriting comparison alone; the investigation must shift to ink dating, paper dating, and intersection analysis.
  • SWGDOC and ENFSI guidelines specify a minimum of 20 to 30 genuine exemplars, spanning varied dates and conditions, as the baseline for any signature comparison.
  • Computer-generated signatures embedded in PDFs are authenticated by cryptographic certificate validation and PDF metadata analysis, not by paper-based examination.

Signature forgery has a documented history reaching back to papyrus contracts in Roman Egypt, where names were erased and reinscribed. English common law addressed forgery through the Forgery Act 1562, which imposed severe non-capital penalties including lifetime imprisonment and forfeiture, but did not classify forgery as a capital felony. Albert Osborn's Questioned Documents (1910) codified the diagnostic criteria that still frame the discipline today. In casework, the forgery spectrum runs from a crude freehand attempt at the target signature through various tracing methods to computer-generated vector images embedded in signed PDFs.

Each category demands a different examination strategy because the diagnostic features that expose one forgery type may be absent or misleading in another. Freehand simulation produces line quality problems that tracing does not, because tracing removes the need to hold the pen path in working memory. Tracing leaves physical evidence of transfer that simulation does not. Auto-forgery leaves none of those physical traces at all, because the signature is genuine.

The foundation of every signature examination is the application of ACE-V methodology to catalogue the questioned signature's features before comparing them against the exemplar set. The instrumental toolkit, led by the Video Spectral Comparator and oblique/UV/IR examination methods, gives the examiner the spectral and topographic data that the naked eye cannot resolve. Where a signature appears on a PDF or digital document, PDF metadata forensics and document image authentication provides the digital-layer analysis that complements physical examination.

By the end of this topic you will be able to:

  • Distinguish the four forgery classes (freehand simulation, traced, auto-forgery, computer-generated) by their characteristic physical and dynamic evidence profiles.
  • Identify the diagnostic criteria that separate simulation from tracing, and explain why applying simulation criteria to a traced signature leads to false conclusions.
  • Describe the role of ESDA, VSC, oblique lighting, and infrared reflectography in signature examination and match each instrument to the evidence type it detects.
  • Explain why auto-forgery cannot be detected by handwriting comparison and identify the document-authentication techniques used instead.
  • Apply the SWGDOC/ENFSI exemplar-collection standard and the ACE-V methodology framework to a signature examination scenario.

Genuine Signatures and Natural Variation

A genuine signature is the product of a motor programme: a learned, automatic neuromuscular routine that produces a consistent movement trajectory without moment-to-moment conscious guidance. The trajectory is defined in terms of velocity, acceleration, pen pressure, pen-lift timing, and pen angle, and it is these dynamic parameters, not the static shape of the ink trace, that encode the most individualising information.

Natural variation is the spread around the habitual signature that appears when the same person signs at different times, on different surfaces, under different postural conditions, with different levels of fatigue, or using unfamiliar writing instruments. For many signers, natural variation is narrow: their signatures look nearly identical across dozens of examplars. For others (particularly people who sign rapidly, informally, or who have highly cursive, abbreviated signatures), natural variation is wide. Neither narrow nor wide natural variation is diagnostically meaningful in isolation; what matters is whether the questioned signature falls within the range established by the examiner set.

Collecting an adequate exampler set is the foundation of a signature examination. Courts in the United States (Federal Rules of Evidence Rule 901(b)(3)), the United Kingdom (Criminal Procedure Rules Part 19), Australia (Evidence Act 1995 s 79), India (Indian Evidence Act s 45, now mirrored in Bharatiya Sakshya Adhiniyam 2023 s 39), and Germany (Strafprozessordnung ss 72-93) all require the examiner's opinion to be grounded in comparison material. For a genuine-versus-forgery question, the examiner needs a minimum of 20 to 30 genuine exemplars spanning a range of dates and conditions, including contemporaneous exemplars closest to the date of the questioned document. The SWGDOC (Scientific Working Group for Forensic Document Examination) guidelines and the ENFSI (European Network of Forensic Science Institutes) Document Examination Working Group guidelines both specify this threshold.

Natural variation envelope: genuine signatures cluster within a bounded range on velocity, pressure and trajectory dimensions
Natural variation envelope: genuine signatures cluster within a bounded range on velocity, pressure and trajectory dimensions; forgeries typically fall outside on at least one dimension even when visual shape is close.

When the questioned signature falls outside the natural variation envelope on multiple independently assessed parameters (pen pressure, slant, proportions, pen-lift pattern, loop openings), the examiner has grounds for an opinion of non-genuineness. When it falls consistently within the envelope, an opinion of probable genuineness is supported, though no forensic document examiner assigns absolute certainty because exemplar sets are finite and conditions vary.

Freehand Simulation

Freehand simulation is the most cognitively demanding forgery method. The forger studies the target signature and reproduces it from memory or a reference copy without tracing, turning the signing act into a drawing exercise: the pen moves slowly, guided by visual feedback rather than a practised motor programme. The diagnostic consequences of this shift are predictable and well-documented.

Pen speed is reduced. Because the forger is monitoring the pen path consciously, the fluent, high-velocity arcs that characterise a genuine rapid signature are replaced by slower, more hesitant strokes. On ink trace, reduced speed produces heavier ink deposition (more time for ink to flow from the pen nib), wider stroke width, and loss of the thin, pointed stroke endings that mark rapid deceleration in a genuine signature. On ESDA (electrostatic detection apparatus) or pressure-sensitive paper, reduced speed produces heavier and more uniform groove marks than genuine signatures.

Pen lifts and tremor are misplaced. Genuine signatures have pen lifts at biomechanically natural positions (typically at the completion of a letter or loop) and smooth, arc-shaped movements between strokes. The simulating forger often lifts the pen where they pause to assess progress, not at the positions dictated by the genuine motor programme. Where pen lifts occur in the genuine, they may be missing in the simulation because the forger is trying to maintain a continuous trace. Tremor in simulation is of a different character than tremor in genuine signatures: genuine elderly or Parkinson's-affected signers show oscillatory tremor at a regular frequency (typically 4 to 8 Hz); simulation tremor is irregular and appears as short, jerky direction changes that reflect the effort to steer the pen.

Retouching is a strong indicator of simulation. When the forger pauses at a perceived error and re-applies the pen to touch up or correct a stroke, the ink under the retouch is double-layered. This double-layering is detectable by oblique lighting, by infrared reflectography (which differentiates pigments with different IR reflectance profiles), and by video spectral comparator (VSC). Double-stroked areas show as darker under oblique light; in some inks (particularly gel inks and certain rollerball inks), retouch produces a discontinuous bead at the stroke edge that is absent in clean, single-pass strokes.

The forger's own writing habits frequently intrude into the simulation, particularly in faster or more casual portions. This leakage of the forger's own letter forms, connecting strokes, or pen-hold habits into the simulated signature provides one of the most individualising features for identifying the forger when a comparison population is available.

Traced Signatures: Methods and Detection

A traced signature is produced by mechanically following the outline of a genuine signature or an intermediate transfer. Because the forger follows a fixed template rather than a memorised trajectory, the resulting ink trace may closely match the visual shape of the genuine. Several tracing methods leave physical evidence, and all tracing shares dynamic-feature profiles that differ from genuine execution.

Carbon transfer tracing is the classical method. A carbon paper (or a paper coated with graphite or chalk) is placed between a genuine exemplar and a blank, and the genuine signature is traced through, leaving a faint outline on the blank that the forger then inks over. The ESDA examination of the traced document will reveal both the tracing groove (from the stylus or pen pressing through the carbon paper) and, if the forger used a second instrument to ink over the outline, double groove marks. Infrared photography distinguishes carbon residue from the overwriting ink. In early railroad bonds forgery casework in the United States, examiners observed carbon residue around ink strokes as a diagnostic marker of carbon-transfer tracing.

Indented tracing uses a stylus or the pen itself to indent the outline of the genuine signature onto a blank by firm pressure, without a carbon intermediary. ESDA examination is diagnostic: the indentations appear as bright white lines in the oblique-light image produced by the electrostatic process. Unlike carbon transfer, indented tracing leaves no chemical residue, only a physical deformation of the paper surface.

Light-box or transmitted-light tracing places the blank over the genuine signature on an illuminated table and traces the shadow of the genuine strokes. The result has no carbon or indentation residue. Detection relies on dynamic features: traced signatures produced by slow, visually guided pen movement share the pen-speed and tremor profile of simulation, but are even more constrained to the template shape. Pen lifts occur at the forger's choice of pausing points, not at the genuine motor programme positions.

Digital projection tracing is a modern variant in which an image of the genuine signature is projected onto paper via a data projector or tracing-light table. The resulting ink trace may reproduce accurate shape but exhibits the same slow-pen-speed and retouch indicators as light-box tracing. On printed forms with a blank signature field, the projector can also leave faint background illumination artefacts detectable under VSC or UV.

Cut-and-paste in electronic documents is the digital equivalent: the genuine signature is lifted from a scanned document and embedded into a new document. Detection relies on metadata forensics (file-creation timestamps, revision history, embedded ICC profiles, image resolution discontinuities at the signature boundary) rather than paper-based examination.

Auto-Forgery and Computer-Generated Signatures

Auto-forgery is the production by a person of their own signature on a document they later deny executing. The signature is genuine in every physical and dynamic sense: no pen-speed reduction, no tremor, no retouching, no transfer residue. Handwriting comparison finds the questioned signature consistent with the writer's known range, because it is within that range.

In its pure form, auto-forgery is undetectable by handwriting examination alone. The question for the document examiner shifts entirely to document authentication: when was the paper manufactured (paper dating via watermark, chemical analysis of optical brighteners, or physical characterisation of fibre composition)? When was the ink deposited (ink dating by solvent ratio degradation, dye fading, or volatile component analysis)? Does the printing on the document predate or postdate the signature (intersection analysis under optical microscopy or under VSC)? Is the document inserted into an otherwise authentic sequence? These questions are answered by techniques outside pure handwriting analysis.

Auto-forgery appears frequently in contract and will disputes. In Patel v. Patel (England and Wales, [2017] EWHC 133 (Ch)), a property transfer document contained a signature that the defendant's own handwriting examiner conceded was consistent with her writing; the case turned on ink chronology evidence placing the signature years after the document's purported date. In Indian succession dispute casework, the Central Forensic Science Laboratory (CFSL) New Delhi has developed protocols for ink volatile component analysis specifically to address backdating in will-related auto-forgery contexts.

Computer-generated signature images present a related but distinct problem. Many document-management systems (DocuSign, Adobe Sign, HelloSign) generate a vector or raster image of a signature from a stylus or touchscreen input and embed it into a PDF. The forensic question is whether the signature image in the document was produced by the legitimate signer through the platform, or whether an image extracted from an earlier transaction was re-embedded. Detection approaches include: PDF metadata and cross-reference table analysis (forensic PDF analysis tools such as PDF-Parser, Peepdf, and Didier Stevens' tools); pixel-level analysis of signature boundary anti-aliasing (genuine embedded images retain consistent anti-aliasing; copy-paste introduces resolution mismatches); and cryptographic signature verification (documents signed through platforms like DocuSign carry an AATL-trusted digital certificate that can be verified independently of the visible signature image, any tampering with the embedded signature invalidates the certificate).

Forgery type diagnostic matrix: each method leaves a characteristic evidence signature across physical, dynamic and metadata
Forgery type diagnostic matrix: each method leaves a characteristic evidence signature across physical, dynamic and metadata dimensions.

Instrumental Examination Techniques

The Video Spectral Comparator (VSC) is the primary instrument for questioned-document examination in accredited laboratories worldwide. The Foster + Freeman VSC6000 and VSC8000 series, and equivalent instruments by Projectina (Switzerland) and REGULA (Belarus), illuminate the document with wavelengths ranging from UV (365 nm) to infrared (1000 nm), and image the document under combinations of reflected, transmitted, and oblique illumination. Inks that appear identical to the naked eye often differ in their near-infrared reflectance, allowing the examiner to distinguish inks of different chemical composition in a single stroke, or to visualise ink under an overwritten correction.

ESDA (Electrostatic Detection Apparatus), marketed by Foster + Freeman as the ESDA2, is the standard method for detecting latent indentations in paper. The document is placed on the ESDA platen, a thin polyester film is applied over it under vacuum, the surface is charged with a corona discharge, and toner particles are cascaded over the film. Toner deposits preferentially in regions of high electrostatic charge, which correspond to the indented areas in the paper. ESDA reveals writing pressure from overlying sheets (used extensively to detect altered or added content on documents beneath) and, in the tracing context, reveals the tracing stylus pressure.

Oblique light photography at 45 degrees or lower raking angles visualises surface topography. Pen indentations, embossed impressions, and retouch areas all cast shadows or highlights under oblique illumination that are invisible under vertical lighting. This technique is part of the standard examination protocol in the US Secret Service's questioned-documents laboratory, the UK Forensic Science Service (now distributed to accredited providers), and the Central Forensic Science Laboratory network in India.

Infrared reflectography and infrared luminescence examination distinguish inks that have different pigment compositions. Carbon-black pigmented inks (many ballpoint and some gel inks) absorb IR and appear dark. Iron-gall inks and some dyes are IR-transparent. This distinction allows detection of overwriting, erasure, and layering where the visible spectrum alone is insufficient.

High-resolution scanning at 1200 dpi or above (flatbed or specialised document scanners with calibrated illumination) supports sub-stroke analysis: measuring stroke width at defined positions, quantifying pen-lift gaps, and mapping ink density variation (heavier deposit at slow-speed curve apexes, lighter at stroke tips) for comparison across exemplars and the questioned signature.

Case Studies That Built the Literature

The Clifford Irving "Howard Hughes" autobiography forgeries (US, 1972) were among the first high-profile cases to apply handwriting comparison and ink analysis in combination. Irving forged correspondence purportedly from Howard Hughes to support a claimed authorised biography contract with McGraw-Hill. The handwriting examination, conducted by Paul Osborn (son of Albert Osborn), identified 24 features consistent with known Hughes exemplars; subsequent expansion of the exemplar set revealed pen-speed reduction and proportional inconsistencies. The case demonstrated that a forger who has studied a target extensively can achieve close visual similarity while still leaving dynamic-feature evidence of forgery.

The Konrad Kujau Hitler Diaries forgeries (West Germany, 1983) demonstrated the limits of handwriting examination when exampler selection is compromised. Three handwriting examiners compared the diaries against exemplars that had also been forged by Kujau: Max Frei-Sulzer, former head of the forensic science department of the Zurich police (Switzerland); Ordway Hilton, an American document examiner based in South Carolina; and a third expert employed by the German police. Their opinions of consistency were accurate given the comparison material: the forged exemplars and forged diaries were produced by the same hand. The authentication failure was resolved by document examination: the paper contained optical brighteners (first commercially produced in 1954), the binding thread contained polyester, and the ink contained chloride compounds, all inconsistent with the claimed 1940s provenance. This case established the doctrine that ink and paper examination must precede or parallel handwriting comparison in historical-document authenticity cases.

The Martin Luther King Jr. signature disputes (US, multiple litigations, 1970s-2000s) involved wills, book inscriptions, and correspondence bearing signatures that were challenged as posthumous additions. Examiners from the FBI, from private practice, and from university laboratories produced conflicting opinions that turned partly on exemplar selection and partly on the threshold for natural variation in a signer who was under extraordinary time pressure through much of his later career. These cases drove the development of formal natural-variation protocols that are now incorporated in SWGDOC guidelines.

In India, the Supreme Court in State of Maharashtra v. Suresh (2000) and the Delhi High Court in multiple forgery matters has held that expert handwriting testimony is admissible as opinion evidence under the Bharatiya Sakshya Adhiniyam (formerly Indian Evidence Act) s 45-47, but that the weight assigned depends on the quality and quantity of the exemplar set. This mirrors the position in the United States under Federal Rules of Evidence 702 and Daubert v. Merrell Dow Pharmaceuticals (1993), where handwriting testimony must satisfy the reliability gatekeeping function of the trial judge, and in England under the Criminal Procedure Rules Part 19, which require the expert to serve a written report setting out the reasoning and the comparison material reviewed.

Key terms
Natural variation
The bounded range of legitimate differences between genuine executions of the same signature by the same person; wider in rapid informal signers, narrower in deliberate formal signers.
Motor programme
The learned, automatic neuromuscular routine that drives genuine signature execution at high speed without moment-to-moment conscious guidance.
Freehand simulation
A forgery produced by visually studying the target signature and reproducing it from memory, without mechanical tracing; characterised by slow pen speed, irregular tremor, and retouching.
Indented tracing
A tracing method in which a stylus or pen presses the genuine signature outline through to a blank beneath, leaving physical indentations detectable by ESDA.
Auto-forgery
A genuine signature executed by the legitimate signer on a document they later deny, undetectable by handwriting comparison alone; requires document-dating and ink-dating techniques.
Video Spectral Comparator (VSC)
An instrument that images documents under UV-to-IR wavelengths in reflected, transmitted and oblique modes; used to differentiate inks, reveal erasures, and detect overwriting.
ESDA
Electrostatic Detection Apparatus; detects latent indentations in paper by charging the surface and cascading toner particles, revealing tracing stylus pressure and writing from overlying sheets.
Retouch
A second application of ink to a stroke by the forger, correcting a perceived error; produces double ink-layer detectable by oblique lighting and infrared reflectography.
Line quality
The composite of pen speed, pressure distribution, smoothness, and stroke-ending taper that distinguishes fluent genuine execution from the hesitant, visually-guided strokes of forgery.
Exemplar set
The collection of known genuine signatures used as the comparison baseline; SWGDOC and ENFSI guidelines specify a minimum of 20-30 exemplars spanning varied dates and conditions.
Practice
Question 1 of 5· 0 answered

A questioned signature shows smooth, accurate shape reproduction closely matching the genuine exemplar set, but ESDA examination reveals a faint linear indentation pattern underneath the ink strokes. Which forgery type is most consistent with these findings?

How many signature exemplars are required for a forensic comparison?
SWGDOC and ENFSI guidelines recommend a minimum of 20 to 30 genuine exemplars spanning a range of dates and signing conditions. Fewer exemplars produce wider uncertainty because the natural variation envelope is less well-defined. Exemplars contemporary with the questioned document carry the most weight, because signing style can evolve over years or decades. The same principle applies to any [handwriting comparison using the ACE-V method](/topics/questioned-document/ace-v-method-for-handwriting-comparison).
Can a forger be identified from a simulated signature?
Sometimes. When the forger's own habitual letter forms, connecting strokes, or pen-hold habits intrude into the simulation, those features can be compared against a suspect's writing exemplars. This 'leakage' of the forger's own writing is most common in faster or more casual portions of the simulation. However, a highly skilled forger who suppresses their own habits successfully may not leave enough individualising features for positive identification. For disguised or opposite-hand writing, see [disguised writing and anonymous letters](/topics/questioned-document/disguised-writing-and-anonymous-letters).
What is the difference between 'probable' and 'definite' on the SWGDOC conclusion scale?
Most professional bodies (SWGDOC, ENFSI, American Board of Forensic Document Examiners) use a nine-point conclusion scale ranging from 'definitely written by' through 'probably written by', 'indications', 'no conclusion', 'indications did not write', 'probably did not write', to 'definitely did not write'. 'Probable' means the evidence strongly favours that conclusion but one or two features are inconclusive. 'Definite' means all assessed features are consistent with the conclusion and none are unexplained. Absolute certainty is almost never appropriate in handwriting opinion.
How is auto-forgery detected if the signature is genuine?
Auto-forgery cannot be detected by handwriting comparison because the signature is within the signer's genuine motor programme. Detection relies on document authentication: paper dating via watermark or optical brightener analysis, ink dating by solvent-ratio decay or volatile-component analysis, and intersection analysis under microscopy to determine whether the printed text and the ink strokes were deposited at the same time. These techniques are covered in detail in [ink dating and paper examination](/topics/questioned-document/ink-dating-and-paper-examination-fibres-watermarks-and-optical-brighteners).

Test yourself on Questioned Document with free, timed mocks.

Practice Questioned Document questions

Found this useful? Pass it along.

Share

Spotted an error in this page? Report a correction or read our editorial standards.

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.