When is an electronic signature not valid?

An electronic signature is not valid when one of the conditions behind every signature fails. The person did not intend to sign, or intended to sign something else. The other side never consented to an electronic method. Someone other than the named person applied it, or they had no authority. The document belonged to a category that needs paper, a witness or another formality. Or the file was altered after it was signed. The medium is almost never the problem. Evidence is.

This is general information, not legal advice, and whether a particular signature holds is decided under the law that governs the document. The laws themselves are compared in electronic signature laws by country. This post works through the failures one at a time, with the record that prevents each.

No intent

A signature marks agreement to be bound. The Law Commission of England and Wales put the test plainly: an electronic signature can execute a document, including a deed, provided the person signing intends to authenticate it and any required formalities are met. Courts judge intention objectively, from the circumstances.

Intent fails in ordinary ways. A name in an email footer while the terms are still being argued. A marked-up draft sent back with “fine by me”. A signature given to one version of a document when the file sent had moved on.

The evidence that prevents it is a deliberate signing step on a fixed document. In the vehicle sale envelope, the seller verifies with a code, initials the identification page, types 84,312 km into the odometer field and signs his block. Nothing about that reads as a comment. The certificate then records, for each signer, the sha256 hash of the document as they saw it, so a later claim that they agreed a different version can be tested against a number.

Be careful with statement boxes as evidence of intent. A checkbox field in this portal is a small box the signer types into, a required one blocks submission while it is empty, and the finished PDF prints an X for any value. That shows the signer marked the statement, not which character they typed. Where one clause carries the risk, initials beside it say more: the guarantor in the loan example initials the guarantee clause itself rather than ticking a box about it.

No consent

Australia’s Electronic Transactions Act 1999 sets out when an electronic method meets a requirement for a signature under Commonwealth law. The method has to identify the person and indicate their intention, it has to be as reliable as appropriate for the purpose or proven in fact to have done that, and, where the signature is given to anyone other than a Commonwealth entity, that person has to consent to the method. The states have their own Acts in similar terms.

In the United States, the ESIGN Act adds a consumer rule. Before records required to be given in writing can be delivered electronically, the consumer must affirmatively consent after a clear and conspicuous statement of their right to paper, their right to withdraw, and the hardware and software needed, and must consent in a way that reasonably demonstrates they can access the records.

Consent fails when nobody asked. The prevention is a consent step the signer cannot skip. In this signing portal, every signer must agree to sign electronically before submitting, the server refuses a submission without it, and the certificate prints the consent timestamp and the version of the wording each signer accepted. The wet signature page covers what happens when the other side insists on paper instead.

Wrong signer, or no authority

A signature binds the person who made it. If an assistant signs a director’s name, or a forwarded link lets a housemate click through, the method did not identify the named person and the signature may not bind them.

Prevention is chosen before sending. An emailed one-time code means the signer reached the inbox again within ten minutes. An access code shared by phone means you spoke to them. The certificate records which check each signer passed, and the audit trail records every failed attempt, so a signature that followed three wrong codes looks different from one that did not.

Authority is a separate failure. An employee without power to bind a company can sign perfectly and still bind nobody. Put the right officers on the envelope and make their capacity visible: the signature block’s Title and Company lines are typed by the signer at signing.

Order matters too. In the loan agreement envelope, the guarantor can only sign after the borrower, because Sign in order is on, and he initials the guarantee clause itself.

Excluded documents and missing formalities

Some documents sit outside general electronic signing rules. The US ESIGN Act excludes wills, codicils and testamentary trusts, adoption, divorce and other family law matters, court orders and official court documents, and several notices, including cancellation of utility services, default, foreclosure or eviction on a primary residence, cancellation of health or life insurance, and product recalls. The Law Commission’s project on electronic execution did not extend to wills or to registered dispositions under the Land Registration Act 2002. Australian states set their own rules for wills and some property documents.

Formalities fail more quietly. A deed may need a witness, a statutory form may need a particular wording. No audit trail rescues a document of the wrong type or a missing witness. The only prevention is checking the governing law before choosing electronic signing, and adding the witness as a signer where the law allows electronic witnessing.

A tampered file

The last failure is a document that changed after signing. An amount edited, a page replaced, a clause removed.

A certifying signature makes that detectable. When the last signer finishes, the PDF is certified with a PAdES signature at DocMDP P=1, which permits no further changes, so a PDF reader flags an edited copy. The audit trail is protected the same way in a different form: each event row is hashed together with the previous row’s hash, and the status page shows “Hash chain verified” or names the event where the chain breaks. The UK Electronic Communications Act 2000 makes an electronic signature admissible on the authenticity or integrity of the data it is attached to, which is exactly the question a certified file answers.

The failure table below maps each failure to what it looks like in practice, the evidence that prevents it, and where that evidence is recorded.

Common mistakes

Signing a draft. Negotiate first, send once. An envelope cannot be edited after it is sent.

Email link only for a high value document. A forwarded link then becomes a plausible denial.

The wrong officer signing for a company. The record proves who signed, not that they could bind the company.

Ignoring a decline. A declined contractor agreement is a recorded refusal, not a signature to chase past.

Claiming a timestamp. No RFC 3161 token is attached in the current setup. Say certified, not timestamped.

Assuming the record settles it. No certificate turns a document that needs paper or a witness into a valid electronic one.

Build it

The tamper proof PDF page explains the certification step, and the e-signature tutorial covers choosing identity checks, signing order and fields. What the service records: 18 audit event types on a sha256 hash chain; per signer, the identity method, signing time, IP address, consent timestamp and version, document hash at signing and signature image hash; and a finished PDF certified at DocMDP P=1. Codes are salted scrypt hashes with a five attempt, fifteen minute lockout, and a verified session lasts 30 minutes. Envelopes expire after 30 days. Every recipient is a signer, with no approver or cc role, so a witness or an authorised officer is added as a signer like anyone else.