"I never signed that": proving an e-signature

How these disputes are argued

A denial is not an argument that electronic signatures don't count. In the United States, the ESIGN Act says a signature "may not be denied legal effect, validity, or enforceability solely because it is in electronic form" (15 U.S.C. 7001(a)), and the Uniform Electronic Transactions Act (UETA), the model law most US states have enacted, adds that evidence of a record or signature "may not be excluded solely because it is in electronic form" (section 13). A denial is a claim about facts: this person didn't make this signature, or didn't sign this version.

In US law, the evidence has to answer three questions:

• Is the document what you say it is? In US federal courts, the party offering a document "must produce evidence sufficient to support a finding that the item is what the proponent claims it is" (Federal Rule of Evidence 901(a)). Accepted ways include testimony and "evidence describing a process or system and showing that it produces an accurate result" (Rule 901(b)(9)).
• Was it the act of that person? Under UETA section 9, an electronic signature is attributable to a person "if it was the act of the person", which "may be shown in any manner, including a showing of the efficacy of any security procedure". The comments published with UETA add that a security procedure "is not accorded operative legal effect, through the use of presumptions or otherwise": it goes to the weight of the evidence.
• Is it unchanged? The committee notes to the 2017 amendments of Federal Rule of Evidence 902 explain hash values as the typical way to identify electronic data. A hash value, or fingerprint, is a short code calculated from a file's contents: change one character and it changes completely.

Other legal systems have their own rules. In England and Wales, a party in a civil case is treated as admitting that a document disclosed to it is authentic unless it serves notice that it "wishes the document to be proved at trial" (Civil Procedure Rules 32.19), and an electronic signature is admissible on questions of authenticity and integrity (Electronic Communications Act 2000, section 7). In the European Union, eIDAS says an electronic signature "shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form" (Article 25(1)), and each country's procedural law decides the rest.

This page is general information, not legal advice.

What to do first

1. Keep the signed copy exactly as it is. Don't edit, re-save or re-send the document. With Attest, any change to the document or a signer's entries makes verification fail, so the original file is your evidence.
2. Verify it yourself. Drop the signed PDF on attest.datahubz.com/verify, on the verifier attached inside it, or on the current verifier at attest.datahubz.com/attest-verifier.html. The file is checked in your browser and never uploaded. Keep a record of the result.
3. Collect the evidence inside the signed copy. Every Attest signed copy holds the signed pages, with a "Signed with Attest" stamp on each signature and a seal line at the foot of every page, a certificate of completion, the audit trail up to completion and a "Verify it yourself, without us" page, with the full evidence file, the original document as signed and the verifier attached inside.
4. Collect the context. Because attribution "may be shown in any manner", emails about the deal, invoices, payments and work delivered under the agreement all help.
5. Show the other side how to check it. Verification is free and needs no account, so the person denying the signature, or their lawyer, can run the same checks you did.
6. Get legal advice before you act on anything significant.

What the evidence answers

Each Attest signer approves with a passkey: a cryptographic key only the signer controls, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. Here is what the evidence shows for each kind of denial.

What they say	What Attest's evidence shows
"I never saw this document."	Their passkey signed a statement that begins "I have reviewed and I sign", naming the document's fingerprint. The audit trail records when they opened their signing link, set up their key and signed.
"That's not my signature."	The signature verifies against a passkey registered to their email address, and the passkey had to confirm the signer was present and verified (Face ID, a fingerprint or the device PIN) before it signed. The drawn image is not what binds them: the passkey signature is.
"I signed a different version."	Their signature names the fingerprint of the exact document and of their entries, and every party holds the same sealed copy. A different version has a different fingerprint and fails verification.
"Someone changed it after I signed."	Change one byte of the document, of any signer's entries or of the signed pages, and verification fails against fingerprints anchored on a public blockchain. A signed copy with anything added to the PDF after it was sealed fails too.
"I signed it on a different date."	The signing time in each statement is set by Attest's server when the signing request is issued and signed by the passkey; the blockchain's block time shows when the signed state was anchored.
"Someone else used my email."	The evidence ties the signature to the invited address and to a passkey registered to it, which had to confirm the signer was present and verified before it signed. Attest confirms control of that email link and the passkey, not a government ID. Correspondence and payments add to that evidence.

Why the evidence doesn't depend on trusting Attest

The central checks in Attest's evidence can be run by anyone, without relying on Attest.

• The signature belongs to the signer. Attest never sees a passkey's secret, so it can't make a signer's signature.
• Anyone can re-check each signature. The evidence stores each signer's passkey public key and signature data, and any WebAuthn library can verify them.
• The record is anchored publicly. Each signature becomes a receipt anchored on the Horizen public blockchain from the signer's own wallet, a blockchain account Attest creates and runs for each user. When the last signer signs, the signed state is anchored from the sender's wallet, and the sealed copy's pages are anchored too.
• The verifier is open source and runs without Attest. It is published under the MIT license on GitHub and runs in the browser, reading only a public blockchain node. It checks the original document inside the signed copy against what every signer signed, each signer's passkey signature and entries, Attest's anchored record of the agreement on Horizen, and that nothing was added to the PDF after it was sealed. It also re-makes every page you see from what was signed and compares the result with the copy byte for byte, so pages drawn with anything else fail. It pins its trust root (the chain, Attest's registry and the keys it checks against are built into the verifier, never read from the file being checked) and accepts only anchors from Attest's registered wallets. A real agreement signed on Attest was verified with Attest blocked, by the verifier inside its signed copy; changing the pages made it fail. The film is on the signing page.

Because each signer's statement names the fingerprints of the document and of their entries, no one, Attest included, can alter either one afterward without verification failing.

Prevent the next dispute

Much of this evidence is set up before anyone signs. Send each request to the address the person already uses with you, put every term in the document itself, give each signer their own signature field, and download the sealed copy when it completes. For people you sign with often, compare the 60-digit safety number on the Security page, which confirms that documents are encrypted to the right person's key. The full checklist is in how to prove someone signed electronically.

Electronic signatures are recognized for most agreements in the United States (the ESIGN Act and UETA) and the European Union (eIDAS). Some documents, such as wills or certain notarized deeds, have special rules in many places: check yours.