Anonymous and Disguised Writings; Signature and Forgery Detection

Anonymous letters reach a QD examiner in two evidence streams, and a careful report addresses both. The handwriting stream looks at the physical writing: letter design, slant, size, spacing, connecting strokes, pen lifts, baseline behaviour, margin habits, and the way numerals are formed. The linguistic stream looks at the language: vocabulary range, grammar, spelling errors, regional usage, idioms, native-language interference patterns when an Indian writer composes in English, and stylometric markers such as sentence length and function-word frequency. The two streams point at different suspect pools and should be reported separately, not collapsed into a single opinion.

Why handwriting still works on disguised anonymous letters is a point NTA likes. Habitual letter designs are over-learned motor programmes. When the writer is under emotional load (a ransom situation, a vengeful poison-pen impulse), conscious disguise effort competes with the over-learned programme, and the original programme wins in places the writer is not monitoring. Common leak points are connecting strokes, i-dots and t-bars, beginning and ending strokes, and numerals. A right-handed writer slanting left to disguise will often slip back to right slant in the third line, and almost always slips on numerals. The examiner builds the case on these consistent leaks rather than on any single conspicuous letter.

Indian linguistic anchors are scoring points. A letter written in English by a Marathi, Tamil or Bengali first-language speaker carries predictable interference: article omission ("I went to market"), preposition substitution ("discussed about"), tense shifts, and characteristic spelling slips. Devanagari, Tamil and Bengali handwriting all have script-specific stroke orders and conjunct-character habits that an examiner trained in the script can read; a Hindi anonymous letter sent from a region where Devanagari is rarely written for daily correspondence is itself an investigative lead. CFSL Hyderabad and GEQD Shimla maintain reference collections for Indian-language handwriting comparison.

The disguise repertoire is finite, and NTA tests it as a closed set.

Slant change. The commonest disguise. A right-handed writer with natural right slant writes with a forced left or vertical slant. Tell-tales: slant inconsistency across the document; reversion to natural slant under fatigue (often by paragraph two or three); awkward connecting strokes; numerals that retain the natural slant because the writer concentrates on letters.

Hand change. Writing with the non-dominant hand. Tell-tales: angular, jagged outlines; tremulous lines from poor motor control; awkward stroke direction (a left-handed writer using the right hand often pushes rather than pulls strokes); low writing speed; large size; widely spaced letters. The habitual letter design still surfaces in the basic shape of capitals.

Block-letter conversion. Switching from cursive to block capitals to suppress connecting-stroke habits. Tell-tales: letter proportion (the ratio of cap-height to width), i-dot habits, spacing between words, baseline alignment and numeral form all carry across from the writer's cursive habit.

Mimicry. Copying another known person's handwriting to misdirect the investigation. Tell-tales: simulated forgery features in every word (slow execution, pen lifts, hesitation), incomplete adoption of the target's habits, and reversion to the writer's own habits in unmonitored details.

Mixed strategies. A determined writer combines slant change, hand change and block-letter conversion. Mixed disguise looks more disguised but breaks down faster because the writer cannot hold three conscious changes simultaneously over a long letter.

The general rule the examiner relies on: disguise is a conscious overlay on an unconscious motor habit, and consciousness has a small working budget. The longer the document, the more the habit leaks. Three-line ransom notes are harder than three-page poison-pen letters.

Signatures fall into four functional classes for QD work. Formal or conventional signatures are the writer's full cursive name as used on legal deeds, passports and bank account-opening forms. They are slow, careful, and most stable across a writer's life. Informal or abbreviated signatures are everyday cursive used on routine paperwork and may differ from the formal version in shortening or stylisation. Initials are reduced signatures, common on internal office correspondence and on each page of a multi-page contract; they carry less individuating information and demand more standards for comparison. Mark signatures cover the illiterate or physically impaired signatory: a cross (X) or thumb impression with attestation by a literate witness as required by the relevant property and registration statutes.

Indian script signatures add a layer. Devanagari signatures appear on Hindi-area government forms; Tamil, Telugu, Kannada, Bengali and other regional-script signatures appear in their respective states; mixed-script signatures (stylised cursive English combined with a Devanagari first-name flourish) are a recognisable class on Indian government and bank forms. The examiner should obtain standards in the same script as the questioned signature. Comparing a Devanagari questioned signature against only English cursive standards is a methodological error that defence counsel will exploit.

Standard sets for signature work follow the same logic explained for handwriting standards: collect contemporaneous, requested and non-requested specimens, ideally five to ten signatures from each of the year before and after the disputed signature. For wills and deeds, the registrar's office, bank account-opening forms, passport applications and earlier registered documents are the standard sources. The proof-of-execution framework lives in BSA 2023 Sections 67 to 73, the modern counterparts of IEA Sections 67 to 73, which govern proof of signature and writing, comparison of signature, and the court's own comparison power.

The classical division is three-fold (freehand, simulated, traced); modern practice adds blind, lifted and electronic. NTA tests all six.

Freehand forgery. The forger writes the target name without ever having seen the genuine signature. Result: total morphology mismatch. Letter design, slant, size, proportion, flourishes and stroke order all differ. Detection is trivial when a single genuine standard is available; the report often runs to one paragraph.

Simulated forgery. The forger copies a genuine signature while looking at a model. The forger draws rather than writes. Tell-tales: slow execution (visible as a wavy, deliberate line instead of a rhythmic stroke), pen lifts mid-stroke where a genuine writer would have run through, hesitation marks (tiny tremor at junctions), patchwork retouching to fix shape, blunt starts and stops where the pen was placed and lifted instead of swept, and uniform pen pressure because the drawing motion does not modulate pressure the way habitual writing does. A skilled simulator producing a "practised" forgery removes the obvious tremor but rarely matches the speed and rhythm of the genuine.

Traced forgery. The forger places the genuine signature under the target document (or on a light box, or transmits light through a window) and traces the outline. Tell-tales: outline matches the genuine too closely, often more closely than two genuine signatures of the same writer match each other; line quality is poor because the forger is following an outline rather than writing; indented outlines may be visible under oblique lighting or ESDA when carbon or a hard pencil was used as the transfer step; ink may be doubled where the tracer corrected the line. The "too-perfect match" is itself the giveaway: natural variation between two genuine signatures by the same writer is always present.

Blind forgery.

The workflow runs in five stages and maps cleanly onto the ACE-V (Analyse, Compare, Evaluate, Verify) doctrine that questioned-document examiners share with fingerprint examiners.

Analyse the questioned signature. Stereomicroscope examination at 10x to 40x for line quality, pen lifts, retouching, hesitation marks. Oblique lighting for indented strokes that suggest tracing. VSC-8000 examination under visible, UV and IR for ink differentiation, alterations and printed-versus-pen substitution. ESDA for indented impressions on the questioned document and any underlying pages, which can reveal a traced template.

Analyse the standards. Obtain contemporaneous formal and informal standards in adequate quantity; check for medical, age and stress effects on the writer in the disputed period. For will cases involving an elderly testator, check for tremor consistent with the writer's medical condition before flagging tremor as a forgery indicator. This is the trap Lalit Popli v. Canara Bank and similar cheque-signature cases turned on: tremor alone is not a forgery indicator without baseline standards.

Compare questioned and standards on a feature-by-feature basis: overall design, slant, size, proportion, baseline, spacing, connecting strokes, beginning and ending strokes, pen pressure, line quality, idiosyncratic letter forms, and numerals where present.

Evaluate the constellation of matches and mismatches. The examiner reaches one of the standard QD conclusions (identified, probably identified, no conclusion, probably not identified, eliminated) using a likelihood-style scale of confidence. Reasons must be reproducible from the report alone.

Verify by a second qualified examiner before the report is signed. CFSL and GEQD both require independent verification before release.

Court frame. BSA 2023 Section 39 (the renumbered IEA Section 45) covers expert opinion on handwriting.

The statutory frame for the forgery half of this topic is the Bharatiya Nyaya Sanhita 2023, which replaces the Indian Penal Code 1860. The key sections to memorise:

• BNS 2023 Section 336 carries the generic forgery offence (IPC Section 463 equivalent), defining forgery as making a false document or false electronic record with intent to cause damage or injury, to support a claim, to cause property to be parted with, to enter into express or implied contract, or with intent to commit fraud.
• BNS 2023 Section 337 covers forgery of public records (court records, public registers, registers of birth, marriage, identity and so on), corresponding to IPC Section 466.
• BNS 2023 Section 338 covers forgery for the purpose of cheating, corresponding to IPC Section 467, the heavyweight provision under which wills, deeds and valuable security forgeries are charged.
• BNS 2023 Sections 339 and 340 cover related offences including using as genuine a forged document or electronic record (the IPC Section 471 equivalent) and possession of a forged document with intent to use.

Adjacent statutory hooks the QD examiner regularly meets:

• Negotiable Instruments Act 1881, Section 138 (cheque dishonour). Signature comparison is the engine of the prosecution evidence in dishonour-by-stop-payment cases where the accused alleges forgery.
• Registration Act 1908 and the relevant state stamp acts for registered instruments where the registrar's standards become the comparison reference.
• Information Technology Act 2000 for electronic signatures and electronic record offences that overlap with electronic forgery.

Reference Indian case-law for the topic:

• Murari Lal v. State of MP (1980, SC), the leading case on the weight of handwriting expert opinion; treat with care, corroborate where possible, do not summarily reject.