Detecting Forgery and Identifying Anonymous Writers

by Joelle Steele

Writing Logo

Forensic graphology is a branch of criminal forensics which involves the analysis of handwritten documents to track down criminals. It uses a combination of examining and comparing handwriting traits and sometimes analyzing the psychological and psycholinguistic components of the handwriting and its content.


Only a small part of an adult's handwriting is written consciously, so handwriting experts search for those characteristics that are written unconsciously or subconsciously. Because so much handwriting is unconscious, forgers cannot easily imitate another person's handwriting exactly and they will automatically include some or all of the fundamental movements from their own handwriting in the forged handwriting. If their line flow, relative slant, pen pressure, letter connections, spacing, tremors, proportions, etc., are very unique, a forgery can be more easily detected.

It is most difficult to establish the identity of the author of a questioned document (suspected forgery) if the forgery was made "freehand" or "simulated." This type of forgery is done by repeatedly practicing writing someone's signature or handwriting style until it looks like the real thing. But while a freehand forgery may look real on the surface, it is never quite perfect and there will inevitably be some very small faults, such as hesitations, tremors, patching, or a lack of rhythm or speed present in the forged handwriting that an expert can see, particularly when they view that handwriting under magnification.

Another form of forgery is tracing. A blank sheet is placed over the original handwriting and held up to the light, or a carbon tracing is made using an original on top, carbon in the middle, and blank page below and then etching the carbon and filling it in. But tracings are not perfect forgeries either. The pressure may not be exactly the same as that of the person whose handwriting is being forged. And, as with freehand forgery, there may be hesitations of the pen and subtle variances in the strokes, such as those found in small hooks at the end of letters or in dots that should really be very tiny dashes, etc.


Successful forgery detection relies on having two main things: 1) as many legitimate original handwriting samples ("standards" or "exemplars") for comparison to the suspected forgery; and 2) the original suspected forgery ("questioned document"). If possible, the exemplars should be similar to the questioned document in form, layout, wording, and content, and should be written during the approximate same time period and with the same or similar type of instrument. For example, known bank checks to compare with questioned bank checks, all written in ballpoint pen, all written within the same six-month period, etc. If there is someone suspected of forging a document, a handwriting sample from that person would be very helpful and should also be written with the same type of instrument.

Many people are concerned about where they can obtain exemplars. This is not as difficult as it seems. There are many sources, some of which can be obtained without a subpoena. Look for address change forms, records (adoption, hospital, school, bank, birth, marriage, court, church, civil, police, public assistance, voting, welfare, veterans, employment, military, unions, voting, unemployment compensation, insurance, trust), licenses, interrogatories, cards, letters, correspondence, bank checks, deposit slips, signature cards, tax returns, transcripts, books, notebooks, notes, agreements and contracts, and applications (credit, employment, loans, insurance, passports, etc.).

Businesses should be especially careful about retaining originals of any and all important documents — not photocopies, scans, microfiche, faxes, or other reproductions. While the technology behind many of these methods has dramatically improved their quality and clarity in recent years, they still cannot duplicate pen pressure on paper, and they are all a little different as far as how much detail they accurately preserve from the original.

An employer once asked me to analyze some sales receipts because they suspected an employee of forging receipts in the handwriting style of one of his co-workers and then giving electronic equipment to his friends who sold it and kicked back a percentage to him. The employer was working with the police off an anonymous tip. I asked the employer if they had the original receipts and they said they did. However, what they called originals turned out to be carbon copies of the receipts; they gave the real originals to the customers. It would have been much better had they given the carbons to the customers instead. Carbon copies from old-style multi-part forms create blurry and fuzzy copies that lack the details so necessary to an accurate analysis.


While there are many sophisticated types of testing that can be done to detect forgery, with most handwriting forgeries, handwriting analysis by eye is all that is necessary. However, infrared viewing can detect chemical erasures and changes in the writing instrument; ultraviolet viewing can detect reflections and absorptions; visible filter viewing detects ink or other absorptions or reflections; infrared luminescence and ultraviolet fluorescence viewing are electromagnetic techniques that detect non-visible reflections and absorptions; and side or oblique lighting or electrostatic detection apparatus (ESDA) can detect imprints or secondary impressions on pages under the original.


In coming to a conclusion about whether a document has been forged, handwriting experts must determine how sure they are that it is a forgery or that a particular person committed the forgery. This is done by a mathematical process that results in a percentage of probability, e.g., 78% possibility that the Will was forged and 89% possibility that it was forged by the decedent's son-in-law.


While a therapist may use graphology to look more deeply into the personality of a patient, that same psychological profiling can also be useful in determining who wrote an anonymous letter, piece of hate mail, threatening letter, ransom note, or hold-up note. In addition, if there is sufficient handwriting in the sample, the handwriting can be linguistically profiled. Linguistic profiling is a specialty of only a handful of handwriting experts worldwide. It involves analyzing the actual content of the handwriting (i.e., what the writer actually says) to uncover additional information about the writer, such as their probable geographical origin, educational level, and even their state-of-mind.

People who write anonymously often try to disguise their handwriting. They may even know something about graphology and attempt to change the size of the handwriting; create variations of i-dots; make slight shifts in slant (usually in the direction of the vertical or leftward slant); apply heavier or lighter pressure; and, form their capital letters differently.

Threatening letters are very common and can be very upsetting to the recipient. At a large corporation in San Jose, California, a newly-promoted female executive began receiving anonymous letters criticizing her and threatening her life. In a company of over 1,000 employees, there were roughly 60 that came under her control and who were affected by her promotion. The list was further narrowed down to twelve who worked in her department or closely with her department. How to find the culprit?

After looking at the letters, I realized that, like most anonymous letters, the writer had made an effort to disguise the handwriting by adding odd little features that would rarely show up in a real handwriting sample. Eliminating those, I tried to find out as much as I could about this person. Since most anonymous letter writers fit certain established profiles, this is a relatively simple matter of examining only the handwriting of those people who fit such profiles. For example, in work situations the typical anonymous letter writer is usually an employee who has been with the company for a long time; has little to no authority; perceives him/herself or is perceived by others as being virtually indispensable; is rarely as efficient as he or she purports to be; has a cluttered desk or work area; has an ongoing series of personal problems; tends to gossip and sometimes even initiates rumors or is the known source for the latest dirt on anyone and everyone; tends to gripe a lot but does nothing to resolve problems; and often intimidates rather than helps new co-workers. There were three such people who fit this profile. After examining their handwriting, I determined which one was the writer of the anonymous letters.

But, my word alone is not enough. A confession is necessary. Since another part of the anonymous letter writer profile dictates that most such writers can be easily broken down under hard interrogation by a police officer, she was questioned and, sure enough, she came clean.

This article last updated: 08/03/2014.