Can an electronic signature be forged?

Quick answer · the 30-second read

Yes, in the sense that someone can sign a document without permission. But not in the way people usually picture, because there is no handwriting to copy. Forging an electronic signature means getting into someone’s email or account and signing as them. Copying how their signature looks achieves nothing. That changes what a court looks at. The question is not whether the signature matches, but whether the signing can be tied to the right person. In practice, a document signed through a proper platform is usually easier to defend than one signed in ink.

Key facts Forging an electronic signature means signing without permission, not copying how a signature looks. Most disputes come from someone using another person’s email or account, not from clever technical attacks. Courts look at whether the signing can be tied to the right person, which lawyers call attribution. In the US, an electronic signature is attributable to a person if it was the act of that person, and this can be shown in any way, including by pointing to the security steps used (UETA, section 9). In the UK, the Electronic Communications Act 2000 makes an electronic signature admissible as evidence about whether a document is authentic or unchanged. The record kept by the signing platform, not the signature image, is key. A signed PDF on its own proves very little. It shows a document exists, not who signed it. Stronger signature types, such as advanced and qualified signatures, check identity more thoroughly and are harder to dispute. A signature applied in ink carries no information about who applied it, when, or from where.

What does forgery mean for an electronic signature?

It means someone signed a document when they had no right to.

With a signature in ink, forgery is about imitation. Someone practises another person’s handwriting until it passes. The question in a dispute is whether the marks on the page were made by the person whose name they spell.

An electronic signature has nothing to imitate. A typed name is just a typed name, and anyone can type it. A drawn squiggle on a screen looks different every time, even when the same person draws it. So copying the appearance of a signature gets a forger nowhere.

What does work is signing as someone else. Getting into their email, opening the link meant for them, and clicking. The signature that results may look nothing like their handwriting, and it is still a forgery, because the act was not theirs.

How do disputes actually arise?

Rarely through anything sophisticated. The common situations are ordinary ones.

Someone else has access to the email account, because it is shared, because a password was reused, or because a device was left unlocked. A colleague signs on behalf of a manager who is away, meaning to be helpful. An assistant who normally handles the paperwork signs something they were not asked to sign. An old signature image saved from a previous document gets pasted onto a new one.

There is also a category that is not forgery at all, but produces the same argument. Someone genuinely signs, then later says they did not, or says they did not realise what they were agreeing to. From the outside these look identical, and the same evidence answers both.

A fourth situation involves companies. A person signs who did not have authority to bind the business. The signature is genuinely theirs, so it is not forged, but the company may still say it is not bound.

What does a court look at?

Whether the signing can be tied to the right person. Lawyers call this attribution, and it is the centre of every dispute of this kind.

US law states the principle directly. Under section 9 of the Uniform Electronic Transactions Act, which most states have adopted, an electronic signature is attributable to a person if it was the act of that person, and that can be shown in any way, including by pointing to the security steps that were used to identify the signer.

UK law approaches it from a different direction. Section 7 of the Electronic Communications Act 2000 makes an electronic signature admissible in evidence on questions of whether a document is authentic and whether it has been altered. The Law Commission confirmed in 2019 that an electronic signature works provided the person signing meant to authenticate the document.

See Are electronic signatures legally binding in the UK?.

So what actually counts as evidence?

The record the signing platform kept while the signing happened.

A good record shows when the document was sent and to which email address, when it was opened, from what internet address, how the signer proved who they were, when each field was completed, and whether the document changed at any point afterwards.

This is the part people underestimate. A signed PDF on its own proves almost nothing. It shows that a document exists with a name on it. It does not show who put the name there.

See What is an audit trail for e-signatures? for what a good record contains.

The practical consequence is that disputes are usually lost on evidence rather than on law. The signing was fine. The record was not kept, or not kept in a form anyone can produce two years later.

Is an electronic signature easier or harder to forge than ink?

Signed in ink	Signed electronically
Forging it means copying how someone writes.	Forging it means getting into their account or email.
Proof usually needs a handwriting expert, or someone who saw it happen.	Proof comes from the record the platform kept at the time.
The page itself holds no information about when or where it was signed.	The record shows the time, the email address used and the method of signing in.
Changing the document afterwards can be hard to spot.	Changing the document afterwards usually breaks the record and shows up.

A forged ink signature leaves no trace beyond the page itself. Proving it is forged usually means hiring a handwriting expert and arguing about loops and pressure. A forged electronic signature leaves a trail. The time it happened, the address it came from, the account that was used. That trail may show something inconsistent with the person who supposedly signed.

None of which makes electronic signing risk-free. It moves the risk somewhere else. Instead of protecting a specimen signature, you are protecting an email account.

Which type of signature is hardest to dispute?

The ones that check identity before the signing rather than recording it afterwards.

A simple electronic signature, such as a typed name, relies on whoever controlled the email address. An advanced electronic signature links the signature to the signer and shows if the document changes afterwards. A qualified electronic signature goes further, because the signer’s identity is verified in advance by an approved provider.

See Types of electronic signature: which method should you use?.

How do you make a signature harder to dispute?

Use a platform that keeps a full record, rather than emailing a PDF and asking someone to sign and send it back.
Send documents to a personal work address rather than a shared inbox, so the record points at one person.
Turn on a second check where it is available, such as a code sent by text. It is the single change that most strengthens the record.
Keep the audit trail with the document. A signed copy filed on its own loses the evidence that supports it.
Never reuse a signature image from an old document. It proves nothing about the new one, and it undermines the documents it appears on.
For high value or contentious documents, consider a stronger signature type where the signer’s identity is checked in advance.