Digital signature tools have become a go-to resource for many brokers and customers in today’s largely remote work era, but according to FINRA, this helpful tool has also increased the risk of forgery or falsification. To bring awareness to this ever-growing problem, FINRA recently released a Regulatory Notice in which warns firms of certain issues involving digital signatures and how to identify when forgery takes place.
The most popular scenarios involving this type of forgery or falsification include:
- account opening documents and updates,
- account activity letters,
- discretionary trading authorizations,
- wire instructions and
- internal firm documents related to the review of customer transactions.
“These types of incidents underscore the need for member firms that allow digital signatures to have adequate controls to detect possible instances of signature forgery or falsification,” the regulator said.
Customer Inquiries or Complaint Investigations
Investigating customer inquiries or complaints is a great place for firms to initially identify situations in which representatives forged or falsified customer signatures. For example, firms have found that customers raised questions or complained about:
- account transfers where firm investigations revealed that representatives facilitated the transfer process by digitally signing forms on behalf of customers; and
- securities transactions where firm investigations revealed that disclosure forms executed in connection with the transaction acknowledging a product’s alignment with the customer’s investment objective and risk tolerance had been forged.
Digital Signature Audit Trail Review
Digital signature platforms generally store identifying information for each signatory on a document, including email address and Internet Protocol (IP) addresses. This is another great place to look when trying to identify if forgery has taken place. Consider, does the customer’s email address used for the signature match what’s on file at the firm? Is there a discrepancy between the location of the user (e.g., the individual affixing the customer’s digital signature) and the customer’s residence? Finally, do the IP addresses for the representative and customer signature on a document match?
Email Correspondence Review
Simple email reviews are also a great way to identify situations where representatives had forged or falsified signatures. For example, firms have identified instances where correspondence showed that documents were sent to non-customer emails, including the representative’s personal email address or that of their assistant, to a representative’s firm-assigned email address, or an address associated with a representative’s approved outside business activity. Therefore, firms were able to identify instances where a customer’s email address changed in ways that were indicative of attempts to conceal information from a customer.
Administrative Staff Inquiries
Training your administrative staff on how to identify red flags and alert management or compliance is another important step for firms to take. Some firms vocalized having experienced situations where administrative staff were directed to manipulate the digital signature process in what the representatives claimed were acceptable accommodations to the customer.
Customer Authentication Supervision
Finally, it may be helpful to use an authentication process when obtaining digital signatures that asks customers to answer one or more questions with personal information to verify their signature. In some instances, representatives have been able to circumvent the authentication process because the verification questions were based on personal information contained in customer files accessible to the representative.
Since representatives often have access to customer information, relying solely on this verification process may miss red flags of potential forgery or falsification. Additionally, your firm should ensure their procedures address safeguards around the authentication process and clearly indicate any restrictions on employee access to, for example, customer passwords and answers to verification questions.