Nowadays, it is more usual for people to type text on computers and mobile telephones than write letters by hand. Consequently, handwritten notes are no longer the norm, the age-old art of handwriting has waned and, sadly, the writing and receiving of love letters have almost died out altogether. Even celebrities have noticed the change: in a 2014 opinion piece in The Wall Street Journal, the American Singer-Songwriter Taylor Swift wrote, “I haven’t been asked for an autograph since the invention of the iPhone with a front-facing camera.”

The digital age has undoubtedly enhanced our way of life in numerous ways, but it has negative and unpleasant consequences. Even though we still interconnect through alphanumeric symbols regularly, the probability of putting pen to paper is at a record low due to the use of digital communications in the workplace and at home. In addition, the use of formal salutations and signatures on emails has been dropped, e.g. the greeting ‘Hi’ has replaced the word ‘Dear’, and sign-offs have changed from the formal ‘Yours faithfully/sincerely’ to the informal ‘Kind regards’ or ‘Best wishes’. Contactless payments have become more popular recently, especially with the advent of the pandemic; most debit and credit card purchases no longer require a physical signature. Microsoft Teams and Zoom meetings have replaced face-to-face meetings and ‘signing’ for a delivery on the dotted line is now virtually non-existent.

The way we communicate has raised an issue for Forensic Document Examiners (FDE). They authenticate handwritten documents, notes and signatures to determine if they are genuine or fake, if alterations have been made and if a signature is a later addition. They also look at more extended forms of writing, such as letters, to determine whether a particular individual wrote a specific piece of handwriting. However, examiners require a sample to be able to compare them, so they collect writing samples identified to be from the individual in question. Therefore, as we write less by hand, other analytical methodologies must come into play to detect forgeries.

Casework

A wealth of crucial evidence can come from examining documents involved in investigations. A kidnapper’s ransom (a sum of money demanded or paid for the release of a captive) note can have unseen impressions that point to where the victim is being held. An affluent individual may have changed or altered the final will and testament, so a family member received a large sum of money. Similarly, a white-collar crime investigation may include the forensic examination of altered financial documents.

Most FDEs have examined signatures on countless cheques, wills, deeds and financial documents. They have scrutinised medical records to see whether a doctor’s signature was added later than initially indicated, perhaps after a claim was submitted. They also examine longer forms of writing, such as menacing or harassing letters and suicide notes; for example, if the apparent suicide victim did not write the message, the police might have a murder on their hands.

Handwritten forgeries

There are two types of handwriting samples: requested writing samples (formal) and collected writing samples (informal). Requested writing samples are gathered from the author under controlled and monitored conditions.

Informal samples originated from the author before the incident in question, usually in the ordinary course of their daily activities.
The selected samples need to have existed or come from approximately the same time period as is under investigation since handwriting changes over time. Therefore, having multiple recognised examples for comparison purposes is crucial, enabling the examiner to consider the changeability in the individual’s writing styles and to ascertain whether a particular piece of handwriting can be attributed to a given individual. It is worth noting that handwriting examination is distinct from graphology, aka “handwriting analysis”, which endeavours to discover character traits from handwriting examination.

Documents

Finding forged document(s), in part or whole, means that the document examiner may need to consider investigating further into the type of printed material present, the paper, any simulated security features, handwriting and signatures. Indented impression evidence may also link separate pages to one another and more.
When examining documents printed by electronic devices, one starting point is determining the type of printing technology involved and then establishing whether the questioned document is an original or a reproduction. It is also possible that multiple printing methods could have been involved in the creation, for example, a printed document that was subsequently photocopied. Once these facts are established, the examiner can examine the style and appearance, formatting and copy distortion.

The documents subject to the examination may contain markings from rubber stamps, embossed seals, watermarks, or other physically printed marks. Stamp analysis starts with the location of the ink source, which could be one of several, for example, the self-inking stamp or the handstamp. The examiner must first confirm that the stamp caused the markings and was not computer-generated. Next, the examiner can turn to the details of the markings, in particular any defects that may be distinctive to an individual stamp. These may be manufacturing defects, such as distortion or misalignment, or a result of use, such as accumulated ink or dirt, or misuse.

Before making supplementary impressions, it is vital to photograph the stamp to preserve its original nature and the chain of custody.¹ The additional impressions need creating on individual sheets that resemble the original document(s). Care needs to be taken to ensure that the new impressions vary concerning pressure and the angle of application. This will result in the examiner making side-by-side comparisons with the original and/or suspect documents. This part of the analysis will also involve positioning signatures and stamps on a document, especially with the alleged use of “cut and paste” to create the forgery.

Detailed examination of computer printouts potentially allows examiners to conclude on the type of printer employed. It is conceivable, for example, that a specific unique defect in the printed document links the printout to an exact device, and identifying patterns provide a digital fingerprint pointing to a particular printer model and device, known as the Machine Identification Code (MIC). It is a digital watermark that certain colour laser printers and copiers leave tracking dots on every printed page. Security experts and journalists have put forward a case in which tracking dots led to Reality Winner being charged with removing classified material and mailing it to a news outlet in 2017.² However, compared with typewriters, it is seldom possible to trace the questioned document back to the device that created it unless computer forensic analysis is employed. Such analysis also comes into play when a document is attached to an email (i.e. the suspect document is digital).

Another aspect is the work of the Questioned Document Examiner (QDE), whose job is to analyse documents subject to interest. The initial examination of questioned paper documents involves testing the colour, thickness, weight and weave pattern³ to conclude on the source of the paper. This work can also include documents that contain indented impressions, which are not visible to the naked eye. These can be recovered using an electrostatic detection device⁴ (ESDA). Indented impressions happen when an imprint is left on the page(s) beneath the one written upon. These impressions are used in investigations to connect evidence between pages or an incident, such as matching a ransom note to a notepad found in the suspected hijacker’s office.

¹ Chain of custody, in legal contexts, is the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of materials, including physical or electronic evidence.

² https://www.justice.gov/opa/pr/federal-government-contractor-georgia-charged-removing-and-mailing-classified-materials-news

³ Weaving consists of arranging lengthwise threads (called the warp) side by side. Then crosswise threads (called the weft) are woven back and forth in one of many different patterns. Weave patterns vary and can be used as forensic evidence

⁴ ESDA works by applying an electrostatic charge to a document containing suspected indented writing. Indented writing (i.e., disturbed fibres) created from previously written documents on overlying pages can then be seen. In some cases, this method can be applied to develop fingerprints on documents.