How to Verify an Electronic Signature

Electronic signature verification means checking the evidence around a signature, not the squiggle itself. Confirm who signed and how their identity was checked, read the audit trail, compare the timestamps, and make sure the document has not changed since it was signed. If the signature is backed by a digital certificate, confirm that certificate is valid and trusted too.

That last point is where most of the confusion starts, so let's separate the two ideas first.

Is verifying an electronic signature the same as validating a digital signature?

Not quite. An electronic signature is the broad legal idea: any electronic mark a person uses to show they agree to a document, such as a typed name, a drawn signature, or a click on "Sign." A digital signature is one specific technology that can sit underneath it, a cryptographic seal created with a certificate.

So the two checks look different:

• Verifying an electronic signature means reviewing evidence: who signed, how they were identified, when they signed, and whether the document still matches what they signed.
• Validating a digital signature means letting software check the math: whether the certificate is genuine, still in force, issued by a trusted provider, and whether the sealed file is unchanged.

Many signed documents need both. A typical business contract signed online is a Simple Electronic Signature (SES), where the evidence trail does the heavy lifting. Advanced and Qualified Electronic Signatures (AES and QES) add certificate-based digital signatures on top.

What are the five checks to verify an electronic signature?

Work through these in order. Each one answers a different question, and together they give you a clear picture of whether the signature can be trusted.

1. Confirm who signed and how they were identified

Start with the signer. Check the name and email address on the signing record against the person you expected to sign. Then look at how they proved who they were.

A signing link sent to someone's email inbox is the baseline. Stronger options leave stronger evidence: an access passcode the sender shared separately, a one-time code texted to the signer's phone, or an ID check that matches a government ID to a live selfie. If the document mattered, the identity step should match that.

2. Read the audit trail

The audit trail is the signing platform's activity log for the document. It records each event in order: when the request was sent, when it was opened and viewed, which verification step was completed, and when each person signed.

Read it like a story. Does the sequence make sense? Did the right person open the document before signing it? Are there unexpected events, such as the request being reassigned to someone else?

3. Check the timestamps and signing details

Every event in the trail should carry a timestamp. Compare those times with what you know about the deal. A contract "signed" before it was sent, or signed by two parties in the same second from opposite sides of the world, deserves a closer look.

Many platforms also record the IP address and device used for each action. You can't treat an IP address as proof of identity on its own, but it helps you spot patterns that don't fit.

4. Make sure the document has not changed since signing

A signature is only meaningful if it still belongs to the exact document that was signed. Certificate-based signatures, the kind used for advanced and qualified signatures, seal the file with a cryptographic fingerprint called a hash. If anyone edits the file afterward, even by a single character, the fingerprint no longer matches and the seal shows as broken.

In practice, this means you should verify the copy that came from the signing platform, not a version that was saved, printed, or re-exported along the way. Re-saving a sealed PDF in another editor can break the seal even when nobody meant to tamper with it.

5. Validate the digital certificate, if the signature has one

When a signature is backed by a certificate, digital signature verification is done by software. Open the file in a PDF reader that shows signature details, such as Adobe Acrobat Reader, and look at the signature panel. You are checking four things:

• The certificate was issued by a trusted provider, not a self-made one.
• The certificate was valid at the time of signing and was not revoked.
• The signature includes a trusted timestamp showing when it was applied.
• The document has not been modified after the signature was added.

Pay attention to where the signing time comes from. If the reader says the time was taken from the clock on the signer's own computer, it was not confirmed by an independent timestamp server, so it carries less weight.

For Qualified Electronic Signatures in the EU, the provider must also appear on the official EU Trusted Lists of qualified trust service providers. Dedicated validation services check those lists for you.

How do you verify a signature that was signed with Sign.Plus?

Every Sign.Plus document comes with the evidence you need for the checks above, so you don't have to piece it together yourself. Your signers don't need a Sign.Plus account, and the evidence is recorded either way.

• Signer identity: senders can add recipient verification before a signer can open the document: a passcode you share with them separately, a code sent by text message, or ID Check, where the signer scans a government ID and records a short selfie video. With ID Check you see a confirmation and the name taken from the ID, while the ID photos and video stay private. While ID Check is on, the request can't be reassigned to someone else.
• Audit trail: each document has a tamper-proof audit trail that logs every action, such as viewed, signed, voided, or rejected, with the person's name, email address, timestamp, IP address, and device. It also records which verification step the signer completed, for example "Verified by Passcode" or "Verified by ID Check."
• Certificate of Completion: the Certificate of Completion collects the evidence in one place: document status, the envelope number, completion date and time, the sender's and signers' names and email addresses, the signatures, signers' IP addresses and location, and tamper-proof timestamps showing when the document was sent, viewed, and signed. It is kept separate from the completed document by default to protect signers' personal data, and you can switch on a setting that merges it into the signed file if you prefer a single PDF.
• Signature levels: Simple Electronic Signatures are the default, and Advanced and Qualified signatures are available on paid plans. With AES, an electronic seal is attached to each signer's signature, adding certificate-based protection on top of the audit trail.
• Qualified signatures: for QES, signers are redirected to Swisscom Trust Services, a Swiss qualified trust service provider, to verify their identity. Swisscom then issues the qualified certificate used for the signature.

If someone asks you to prove a document was signed, the Certificate of Completion and the completed document are the two files to share. Sign.Plus doesn't put a clock on that evidence: completed documents stay available while you use them, and the audit trail and Certificate of Completion are kept indefinitely.

Evidence is only as trustworthy as the platform that keeps it. Sign.Plus is certified to ISO/IEC 27001:2022 by EY CertifyPoint and has a SOC 2 Type 2 report from EY. Documents are encrypted with TLS 1.2 or higher (TLS 1.3 supported) in transit and AES-256 at rest. The details are in the Alohi Trust Center.

How do you verify a digitally signed PDF from someone else?

Sometimes the document didn't come from your own platform. A supplier sends a signed PDF, or a bank returns one with a certificate-based signature. You can still check it:

1. Open the original file in a PDF reader that displays signature information.
2. Open the signature panel and look at the status of each signature.
3. Check who the certificate was issued to and who issued it.
4. Confirm the reader reports that the document has not changed since signing.
5. For EU qualified signatures, run the file through a validation service that checks the EU Trusted Lists.

A status such as "validity unknown" usually means your reader doesn't yet trust the certificate's issuer. That isn't proof of fraud, but it is a reason to confirm the details with the sender before relying on the document.

For a simple electronic signature with no certificate, there is nothing for a PDF reader to validate. Ask the sender for the signing platform's audit trail or completion certificate instead.

What can't signature verification prove on its own?

Verification tells you who signed, when, how they were identified, and whether the document changed. It doesn't decide whether the document is legally enforceable.

Whether a signature is valid for a given document depends on the law where it is used and on the type of document. In the US, the ESIGN Act and UETA recognize electronic signatures for most commercial transactions, with exceptions. In the EU, eIDAS defines three levels (simple, advanced, and qualified), and Switzerland's ZertES uses a similar tiered model with the qualified signature at the top. Some documents require the qualified level. UETA also says a signature can be attributed to a person in any manner, including by showing that a security procedure worked, which is why the identity checks above matter. A clean audit trail supports your case, but it doesn't replace the right signature level or legal advice for a specific situation.

What are the warning signs of a tampered or fake electronic signature?

Most problems show up as gaps or contradictions in the evidence. Slow down and ask the sender for the original records if you spot any of these:

• No evidence at all. The signature is a pasted image in a PDF, with no audit trail or completion certificate behind it.
• A broken or missing seal. Your PDF reader reports that the document was changed after it was signed.
• Names and emails that don't match. The signing record shows an email address the signer doesn't normally use, or a different name than the one on the contract.
• A sequence that doesn't make sense. The document was signed before it was opened, or the request was reassigned to someone you don't know.
• Timestamps that don't fit. Signing times fall outside anything that matches how the deal actually happened.
• A copy that has been through other hands. The file was re-saved, printed and rescanned, or exported again, so it no longer matches what was signed.

None of these proves fraud on its own. Each one is a reason to go back to the source before relying on the document.

Electronic signature verification checklist

Keep this list handy the next time a signed document lands on your desk:

• The signer's name and email match the person you expected.
• The identity check fits how important the document is.
• The audit trail shows a sensible sequence: sent, opened, verified, signed, completed.
• The timestamps line up with what you know about the agreement.
• You are looking at the original file from the signing platform, not a re-saved copy.
• The document shows no changes after signing.
• Any digital certificate is valid, trusted, and was in force at the time of signing.
• You have the completion certificate or audit trail saved alongside the signed document.

Want every document you send to come with this evidence built in? Add recipient verification to your next Sign.Plus signature request.