Fraud Investigations

Fraud Investigations


In many cases involving dispute, there is a potential for documents, which contain handwriting and/or handprinting for which questions may arise concerning authorship. Wills, endorsements on checks, letters, credit card applications or sales invoices, bank documents and even scribbled notations are just a few of the types of documents in which the identification of the author of the writing thereon may prove to be of value.  

Forensic document examination, questioned documents, handwriting questions, handwriting identification and questions regarding fraud or forgery are addressed.


On many occasions it is possible for the document examiner to state with no reservations that a particular individual did or did not write a specific written entry. On other occasions, because of the limited or general nature of the questioned writing, the lack of a sufficient amount of known (specimen) writing, disguise in the questioned or known writing, or other reasons, it may not be possible to state the results with complete certitude but a qualified opinion may be expressed. Depending on the weight of other evidence in the case, these qualified opinions may still be of value in subsequent decisions or prosecutions. The following is offered as the types of opinions that may be expressed by document examiners in handwriting cases, which for the purpose of this discussion, include handprinting cases:

Identification (definite conclusion of identity):

This is the highest degree of confidence expressed by document examiners in handwriting comparisons. The examiner has no reservations whatsoever, and he is certain, based on the evidence contained in the handwriting, that the known writer actually wrote the writing in question.

Strong probability (highly probable, very probable):

The evidence is very persuasive, yet some critical feature or quality is missing so that identification is not warranted; however, the examiner is virtually certain that the same individual wrote the questioned and known writings.


The evidence contained in the handwriting points rather strongly toward the questioned and known writings having been written by the same individual; however, it falls short of the virtually certain degree of confidence.

Indications (evidence to suggest):

Some handwriting may have few features, which are of significance for handwriting comparison purposes, but those features are in agreement with other writing, suggesting that the same individual may have prepared them. Note: This is a very weak opinion and some examiners doubt the desirability of reporting an opinion this vague, but those examiners who are trying to encompass the entire gray scale of degrees of confidence may wish to use this or a similar term. Usually a statement that the evidence is far from conclusive follows this opinion.

No conclusion (totally inconclusive, indeterminable):

This is the zero point of the confidence scale. It is used when there are significantly limiting factors, such as heavy disguise in the questioned and/or known writings or a lack of comparable writing, and the examiner does not have a leaning one way or the other.

Indications did not:

This carries the same weight as the indications term above; that is, it is a very weak opinion.

Probably did not (unlikely):

The evidence points rather strongly against the questioned and known writings having been written by the same individual, but as in the probable range above, the evidence is not quite up to the virtually certain range.

Strong probability did not (highly unlikely):

This carries the same weight as strong probability above; that is, there is a virtual certainty that the questioned and known writings were not written by the same individual.


This, like the definite conclusion of identity, is the highest degree of confidence expressed by the document examiner in handwriting comparisons. By using this degree of confidence, the examiner denotes no reservation in the opinion that the questioned and known writings were not written by the same individual. Often, this is the most difficult determination made by a document examiner, especially in limited writings, such as single signatures, when the only known writings are those provided by the suspect at the request of the investigator.


The most important thing than submitter can do to assist the document examiner in handwriting cases is to obtain proper exemplars from potential writers. Although a great detail is available concerning the amount and types of handwriting specimens (exemplars) that should be obtained, the following is offered as the most common problems found in cases submitted for examination:

Failure to get all of the questioned material repeated: The writing in the body of fraudulent applications is usually more readily identifiable than the signature, and the addresses that are parts of check endorsements, if they are repeated, are often of value in the comparison process.

Wrong writing style:

Cursive (script) handwriting cannot be compared with handprinting, nor can upper-case (capital) letters be compared with lower-case (small) letters. It is necessary to have suspects write the specimen writing in the same style as represented by the questioned text.

Insufficient repetitions:

A rule of thumb is that the less the amount of questioned writing, the more times it is necessary to have the suspect repeat it. A single questioned signature or endorsement should be repeated twenty to thirty times, whereas only representative portions of a three-page letter need to be repeated.

Writings are not contemporaneous:

Most people’s writing changes over time, and sometimes those changes are rather drastic; so it becomes necessary to obtain non-request specimens, which were executed around the time as the questioned writing.

Claim forms not submitted in true payee cases:

When false claims are made, it is natural for the payee to disguise his request specimens; therefore, it is essential that non- request signatures be examined before a meaningful comparison is possible. In check cases, often the most readily available source of those signatures is the claim form. Even in suspected forgery cases, it is often helpful to examine the payee’s writing in order to determine whether the signature may be an attempted simulation or a tracing of a genuine signature.


Erasures (physical removal), eradications (chemical removal) and obliterations (overwriting or opaquing) are frequently encountered when attempts are made to hide or alter written entries.


The document examiner has many tools that can be effectively used to decipher erased, obliterated or eradicated writings. The success of these attempts at decipherment varies depending on the writing instrument, the writing surface and the degree of obliteration. Many times it is possible to restore or decipher the original information and this evidence can be of great value in solving a case.


A document containing a suspected alteration should be handled with extra care to prevent further damage to any potential evidence. Place the document in a protective envelope and avoid unnecessary folding or marking. Label the protective envelope prior to inserting the evidence to prevent further marks or indented writings. A request for this type of analysis must be done prior to any treatment for latent prints, since the chemical treatment for latent fingerprints often destroys any evidence of this nature.


Sometimes the date of a written ink entry on its own or else relative to other entries on the same document is questioned.  Chemical tests can be conducted that may determine how long the ink has been on the document and whether a document entry has been falsely dated.  Documents bearing such entries may be single page documents or bound documents, such as journals, calendars or diaries. A destructive technique is used for this examination, i.e., small samples of the ink line are removed from the paper.


It is possible to determine that an entry on a questioned document was placed on that document at a time other than that indicated.


All documents submitted should be properly inventoried and submitted to the lab.


Occasionally signatures are forged by either carefully copying (imitating) the signature from a model genuine signature or from memory of the general appearance of the signature being copied; or the signature may be traced from a model signature by such methods as using back lighting (sometimes called a window tracing), an indented outline, or a carbon outline.


Although it is seldom possible to identify the author of a simulation and never possible to identify the author of a tracing by handwriting comparisons, it is possible to determine that the signature in question is in fact a tracing or simulation, and sometimes it is also possible to find the actual model signature.


In addition to obtaining request exemplars in questioned signature cases, it is also advisable to obtain non-request signatures such as those found on cancelled checks, especially if it is suspected that a tracing or simulation has occurred.

Forensics Home