The signature looks real. Was the signer?

The executive risk is already real

On November 5, 2026, US prosecutors announced charges over an alleged scheme that used AI to impersonate corporate executives and attorneys and obtain approximately $129 million. The alleged playbook combined a supposed CEO, a confidential transaction and a supposed lawyer reinforcing the story. The Justice Department's announcement describes how voice and image impersonation can target the people responsible for consequential business decisions.

The broader warning is established: the FBI says generative AI helps criminals make fraud more convincing and reach more targets, including through cloned voices and fabricated executive video calls.

For a CEO, the uncomfortable question is operational: when a convincing request reaches finance or legal, which control forces the claimed person to participate? If the answer is a familiar name, an email thread and a signature image, the company may be checking the presentation of an identity instead of the identity evidence.

AI agents could extend that problem by preparing documents, maintaining conversations and coordinating many attempts at once. A business should plan for that scale: more convincing requests, more plausible identities and more pressure on people who approve agreements. Make verification part of the workflow, rather than expecting a busy reviewer to spot every imitation.

A signature is a weak identity test

People do not reproduce every pen stroke exactly each time they sign. NIST's forensic-document definition of natural variation recognizes ordinary differences across repeated handwriting. A genuine signature can therefore look different from an earlier one. Meanwhile, a copied digital image can match that earlier signature perfectly.

That creates a terrible shortcut for an approval process: a mismatch need not mean forgery, and a match need not mean the person was there. A signature image is also portable. Once it is present in a PDF, an image or an old contract, its appearance can be copied without recreating the original act of signing.

A drawn or typed mark belongs in the record of agreement. Give it stronger evidence behind it: a required verification step, the signing action and a sealed copy of the agreed document. That is a more useful basis for trust than asking whether a scribble looks familiar.

An authentic file can preserve an inauthentic act

Imagine an attacker gains access to a signing link, enters a name and completes a document. A perfectly functioning seal could then preserve exactly what the attacker submitted. Nothing has to be altered afterwards. The weakness happened before the seal.

You need evidence about the document and evidence about the signing action. SignThis combines a sealed, timestamped PDF with an audit trail. VerySecure adds the palm-verification requirement before the signature is accepted.

Why a palm check raises the impersonation barrier

Very's litepaper describes contactless palm-print verification using a standard phone camera, with randomized hand gestures intended to resist replay. Its rationale is that detailed palm samples are less readily available online than facial images. That makes a palm a useful additional challenge beyond the public photos, recordings and signature samples an impersonator might collect.

Very uses palm-print recognition: enrollment establishes the person's biometric reference, and subsequent verification checks a palm against that enrolled identity. For signing, this puts a fresh verification step between access to the document and acceptance of the signature.

What VerySecure requires before a signature counts

1. The sender chooses VerySecure before sending. It is an optional feature on eligible paid plans. Tick it for any or all signers. Each selected signer must pass the check before signing; Account settings can make it the default for new documents.
2. The signer reads the notice and agrees to palm verification. They use the Very app on their phone; the desktop flow provides a QR code. A recipient does not need a SignThis account, but does need the Very flow.
3. SignThis checks the result in the signing session. A successful pass must be used within 30 minutes in that session. A pasted signature or a bare API request does not satisfy this requirement.
4. Returning signers must match the linked identity. The first successful Very identity for an email address is linked within the sender's workspace. Later VerySecure documents to that address from that workspace require the same identity.
5. One verified identity cannot occupy two palm-verified signer roles on the same document. Creating two email addresses does not bypass that check when both return the same Very identity.
6. The evidence is recorded. The audit trail connects the palm check to the signing event, and the audit certificate records verification. The completed document is sealed and timestamped.

For an attacker, a stolen signature image or signing link is therefore insufficient by itself to satisfy a VerySecure signing session. For the recipient, the record contains more than an assertion that someone clicked a button. It contains the result of the required check and its connection to the signing action.

Build a verified relationship that carries forward

Establish the connection once. Require it again when they sign. During trusted counterparty onboarding, the first successful palm check links that recipient's email address to their verified Very identity in your workspace. On later VerySecure agreements, SignThis requires that same identity to return and verify.

That gives repeat business a consistent verification standard. A familiar name, a copied signature or a convincing message cannot substitute for the required palm check. Your supplier, client or contracting partner follows the same verification process each time you send them a VerySecure document.

The result becomes evidence you can retain: which check passed, when it passed and the signing action it accompanied. For finance, legal and procurement teams, continuity becomes part of the document record rather than something a reviewer has to infer from appearances.

Privacy: the signing platform does not need your palm image

SignThis receives a verification result and a stable provider identifier, not your palm image or palm model. It protects the stored identifier and scopes the email association to the sender's workspace. The audit record includes a fingerprint and reference to the check.

Very handles biometric processing under its privacy policy, which explains palm models, audit images, retention and deletion controls. This separation lets SignThis retain the signing evidence while Very operates the biometric verification. Adult signers review the notice and consent before using the Very app.

Let agents prepare the work. Require a person at the signing step.

AI can be useful for preparing agreements and organizing a signing workflow. That usefulness does not make an agent's output evidence that the named person approved it. With VerySecure selected, the signer must still complete the required verification and signing action. An authorized assistant can help with preparation without being treated as the human signer's identity.

Start with documents where impersonation would be costly: material supplier agreements, sensitive authorizations, investment documents and contracts with established counterparties. Choose VerySecure before sending, verify the initial relationship, and preserve the sealed copy and audit certificate. See how SignThis preserves that evidence.

VerySecure uses 1 envelope per palm-verified signer on Secure, or 2 per signer on other eligible paid plans. Secure is $49/month with 400 envelopes/year. There are no free palm checks; recipients are not charged to sign. Compare current plans and availability.

For the technical rationale and evidence model, read palm verification for electronic signatures.

Research checked November 13, 2026. Provider descriptions are attributed to Very; SignThis behavior reflects the live integration.