A twelve-page will arrives at probate. The signature page matches the testator's known hand. Two living witnesses are named. But the family insists that page seven — the residual estate clause that gives everything to a single beneficiary — was never there. The testator's lawyer has no copy of the draft. The "original" is missing. All anyone has is a scan, and the scan looks perfectly normal at reading distance.
This is what a disputed will or contract usually looks like. The fight is rarely about what the document says. It is about whether the document is what it claims to be.
When a will or contract is challenged, the document itself becomes the evidence. Forensic analysis decides who is telling the truth.
Why Wills and Contracts Are Uniquely Vulnerable
The stakes are at a historic high. Cerulli Associates estimates USD 124 trillion in wealth will pass between generations globally through 2048 — the largest wealth transfer in modern history. The volume of contested estates is already climbing in step: in England and Wales, more than 11,300 wills were challenged in a single recent year, a 56% jump on pre-pandemic levels, and Australian and US courts report parallel growth. When the prize is this large, the temptation to alter a single page, a single date, or a single signature scales with it.
Three structural features make legal documents an exceptional target for tampering. First, they are usually executed years before they matter. Witnesses die or forget, the drafting lawyer retires, and the only people with strong feelings about the contents are the people who stand to gain or lose. Second, the original physical copy is frequently lost, and the dispute is fought over a scan, a photocopy, or a photocopy of a photocopy. Third, these documents are multi-page and rarely initialed on every page in a way that defeats substitution, which means a forger does not have to fabricate a whole document — they only have to replace one interior page.
Most tampering in this category is small. A date is moved. A beneficiary is changed. One clause is inserted. One page is swapped. The forensic signals below are built around catching exactly that kind of surgical edit.
Signal 1: Page Substitution and Cross-Page Consistency
Genuine multi-page scans share a fingerprint across every page: the same scanner glass dust, the same compression settings, the same skew, the same paper noise. A page that came from a different source — printed later, scanned on a different device, or re-saved through different software — almost never matches.
Forensic analysis compares pages against each other on DPI, JPEG quantization tables, noise patterns, scanner artefacts, and Error Level Analysis (ELA) baselines. A single page that breaks the chain is flagged immediately, even if its contents are perfectly plausible.
For wills and contracts, this is the dominant attack vector. The signature page is real. One interior page is not.
Signal 2: Signature Stroke Analysis
Genuine handwritten signatures show variable pen pressure, natural pen-lift points, micro-tremors, and a rhythm that is consistent across pages signed in the same session. Tampered signatures break that pattern in characteristic ways:
- Uniform stroke width, suggesting a digital pen tool or a traced outline
- Identical pixel-level shape across multiple pages, suggesting copy-paste
- Rasterization or anti-aliasing artefacts at high zoom that betray a pasted image rather than ink on paper
- Ink colour or saturation that does not match the witness or notary ink on the same page
This is forensic triage, not handwriting expert testimony. Its job is to tell you whether the signature is worth taking to a court-qualified examiner — and which page or which field to point them at first.
Signal 3: Inserted Clauses and Font Metric Mismatch
A clause added to a contract years after execution almost never matches the original at the level of character rendering. Even when the same template and font family are used, the kerning, baseline alignment, character spacing, or font-weight rendering differs slightly between rendering engines and software versions.
Character-level font analysis treats every numeric field and every paragraph as a sample. The inserted clause stands out as a statistical outlier in its own document — even when a human reader would not notice.
Signal 4: Date and Numeric Alterations
Dates and dollar amounts are the most commonly altered fields in contracts and codicils. They are short, isolated, and visually unforgiving — change one digit and the consequences are enormous. They are also the easiest fields for forensic analysis to scrutinise.
An altered numeric field typically fails three independent checks at once: ELA shows elevated noise where the original digit was painted over, font metrics show a slight shape or spacing mismatch, and the underlying PDF text layer often retains the original value because the editor only modified the visual layer. A triple failure on a single field is high-confidence evidence of tampering.
Signal 5: Initials, Witnesses, Notary Stamps
Wills and contracts often require initials on every page plus witness signatures and a notary stamp or seal. Each of those is its own forensic surface:
- Initials. Are they present on every page they should be on? Do their strokes match the testator's full signature? Were any pages re-initialed in a different ink session?
- Witnesses. Do the witness signatures share the pen, paper, and scan session of the principal signature, or were they added later?
- Notary stamps. Are the stamp's edge sharpness, ink density, and scan resolution consistent with the page they sit on? A stamp pasted in from a different scan is one of the more common forgeries in this category.
Notary stamps are not authentication. A real-looking stamp on a substituted page is the oldest move in the book. Treat the stamp as one signal among eight, not as the answer.
Signal 6: Print-Then-Scan Laundering
Sophisticated forgers know that PDF metadata, text layers, and editing history can betray a digital edit. Their workaround is to make the change digitally, print the document, and then scan the printout. The result has no PDF text layer to contradict the visual content and no obvious modification metadata.
Print-then-scan creates its own tells. Compression artefacts double up because the document was compressed once at print and again at scan. Banding from the printer head crosses the page in regular stripes. Scanner-glass noise overlays an otherwise clean print. The metadata is too clean — a "scanned original" with no scanner identification, no DPI variation, and a timestamp that does not match the claimed execution date.
This is the single most important reason metadata on its own is never enough to clear a disputed document.
Signal 7: Metadata, Creation Tool, and Version History
A will allegedly executed in 2009 should not show a creation timestamp from a 2023 build of Acrobat. A "scan of the signed original" should carry scanner metadata, not Microsoft Word as its producer. Multiple incremental PDF updates on a document that should have been signed and sealed once are a strong signal that someone went back and edited.
Forensic analysis cross-references PDF object metadata, XMP, EXIF on embedded images, and the incremental update history of the file. Each of those carries part of the story, and they have to agree.
Signal 8: Synthetic and AI-Generated Documents
The newest category in this space is the fully synthetic document — a will or contract generated end-to-end by a language model, with a fabricated signature image composited on. These pass casual visual review easily, including by lawyers, because they are internally coherent in a way human forgers rarely manage.
AI-generated content detection, C2PA provenance checks, and template matching against the layouts of legitimate institutional documents are the three signals that catch this class. A "scan" with no scanner noise, no compression history, and a layout that does not match any known template is its own confession.
Single signals are noisy on legal documents — old scans, generation-loss photocopies, and unusual PDF producers can each trip a check on a perfectly genuine document. The verdict comes from multi-signal adjudication: the AI weighs every signal against the document type and context before issuing authentic, suspicious, or likely tampered.
What This Means in Practice
For an heir, a claimant, or anyone who suspects a document is not what it claims to be: get every page scanned at the highest resolution your device supports, preserve the physical original if one exists, and run forensic analysis before depositions or mediation. Triage first, expert later.
For a lawyer: a sixty-second forensic pass tells you whether to engage a court-qualified handwriting examiner, and — more importantly — which page and which field to point them at. Forensic analysis does not replace expert evidence in probate or contract litigation. It narrows the fight, prioritises expert time, and gives you a defensible reason to demand the physical original be produced.
Check a disputed will or contract
Upload every page of the document and get a forensic verdict across all 8 signals in under a minute. Free to start.
Start free →FAQ
- Can TamperCheck replace a court-qualified handwriting expert?
No. Forensic analysis is triage — it tells you which pages, fields, and signatures warrant expert examination, and gives the expert structured evidence to start from. The expert's report is still what carries weight in probate or contract litigation.
- What if I only have a photocopy of the will, not the original?
Most of the eight signals still apply. Page substitution, font metric mismatch, text-layer/visual-layer discrepancy, and metadata checks survive photocopying. Signature stroke analysis degrades the further you are from the original — generation loss blurs the pen-lift and pressure detail — but it still flags copy-paste and traced signatures.
- Is forensic analysis admissible in probate or contract litigation?
Forensic analysis is generally treated as supporting evidence that helps an expert form an opinion, rather than as a standalone verdict. Admissibility and weight vary by jurisdiction — check local rules of evidence. The practical value is that it focuses expert time and gives you a defensible reason to compel production of originals.
- What is the most common form of will tampering?
Single-page substitution. The signature page and most of the document are genuine, but one interior page — typically the residual estate or beneficiary clause — has been replaced. This is the attack the cross-page consistency check (Signal 1) is built to catch.
- Where can I read more about the broader document tampering landscape?
Disputed wills and contracts sit inside a larger ecosystem of document fraud that also includes tampered bank statements, fake identity documents, and contract fraud in rental applications. Our complete guide to document tampering and fraud covers every category, signal, and use case in one place.