Schneier on Security
A blog covering security and security technology.
« Erasable Ink Scam |
| Photo ID Required for Pancakes »
November 29, 2006
Many countries have the concept of a "notary public." Their training and authority varies from country to country; in the United States, their primary role is to witness the signature of legal documents. Many important legal documents require notarization in addition to a signature, primarily as a security device.
When I get a document notarized, I present my photo ID to a notary public. Generally, I go to my local bank, where many of the employees are notary publics and I don't have to pay a fee for the service. I sign the document while the notary watches, and he then signs an attestation to the fact that he saw me sign it. He doesn't read the document; that's not his job. And then I send my notarized document to whoever needed it: another bank, the patent office, my mortgage company, whatever.
It's an eminently hackable system. Sure, you can always present a fake ID -- I'll bet my bank employee has never seen a West Virginia driver's license, for example -- but that takes work. The easiest way to hack the system is through social engineering.
Bring a small pile of documents to be notarized. In the middle of the pile, slip in a document with someone else's signature. Since he's busy with his own signing and stamping -- and you're engaging him in slightly distracting conversation -- he's probably not going to notice that he's notarizing something "someone else" signed. If he does, apologize for your honest mistake and try again elsewhere.
Of course, you're better off visiting a notary who charges by the document: he'll be more likely to appreciate the stack of documents you've brought to him and less likely to ask questions. And pick a location -- not like a bank -- that isn't filled with security cameras.
Of course, this won't be enough if the final recipient of the document checks the signature; you're on your own when it comes to forgery. And in my state the notary has to keep a record of the document he signs; this one won't be in his records if he's ever asked. But if you need to switch the deed on a piece of property, change ownership of a bank account, or give yourself power of attorney over someone else, hacking the notary system makes the job a lot easier.
Anyone know how often this kind of thing happens in real life?
Posted on November 29, 2006 at 7:19 AM
• 73 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Well, I honestly do not know about US - I live in Russia. But in Russia it happens every now and then - some estimates claim that above 20% of real-estate here were aquired through similar manipulations.
Downright bribery (a "social engineering bruteforce ;-)" of a sort ) is also quite common whithin our notary public.
Once upon a time the notary public witnessed both people signing a contract which was what they where originaly intended for.
So that if a dispute arose in future between the parties the notary could attest in court to the legitamcy of both parties signitures, and importantly the date.
Their other role was to attest to the fact that a copy of a document was the same as the original.
Nowadays due to mission creep they often only witness one signature on all sorts of different documents and effectivly their role has been extended which is what opened the door for this type of fraud.
This was partly due to people muddeling the two seperate purposes of the notary public in their heads.
It is almost exactly the same situation that Double Entry Book Keeping was designed to do, ie one clark did one side another did the other in seperate ledgers. The result was the business owner could quickly see if anything was up by comparing the ledger entries.
However in the modern world DEBK is done on a computer with only one person doing the entries, the security of the system is gone.
As you have observed in one way or another in the past extending a security role without thought to the security implications often opens the door to security failings.
In Greece, the notary public is a job on its own, a very important one.
A notary public usually has to be present when signing a contract, a will or other important documents. In many cases a whole family trusts a certain notary public for more than a generation; and it is quite common for the job to be passed from father to son.
AFAIK, you need to be a laywer for quite a few years, and then pass certain exams to take this job. Not suprisingly, they do take their expensively-priced job pretty seriously.
So it's really not as easy as getting a lot of documents and try to keep him/her busy. They will take a good look at all of them, and keep a record for each and every one of them.
Slovenia also has a system much like Dimitris describes for Greece - the notaries are rather well-paid and will look at what they're signing rather carefully. They often offload smaller-value notarizations to their assistants, but these are still legally trained personnel who in my experience have paid attention to what they were signing.
Great article as usual, and you bring up an important point which I never see discussed: would a person (notary, TSA employee, airline ticket agent, etc.) really know a valid West Virgina license if they saw one (or better yet -- a North Dakota license -- I'm not even sure North Dakota actually exists, much less having seen their official license!)
Can any one person really be expected to be capable of determining the authenticity of 50+ versions of various drivers licenses and state-issued identity cards? And if they could, I'm sure they're probably more suited to a different line of work than one that involves checking ID's.
Same thing in Spain. Moreover, many important documents are typed on special paper (at a special price, for example) with public seals, and they are even numbered. Once you meet with the other side to sign something (say, a mortgage), and your identity is checked (national ID card, passport or equivalent), the notary reads EVERY single word written on it. Only then is the contract signed, with his own signature on it. There's no way you can just slip an additional document for notarizing. After all, they charge by the page.
Many of these scenarios depend on the (lack of) diligence of the notary. Some will scrutinize signatures more closely than others, especially if they weren't signed in their presence. Others will just let it pass and stamp away. These are human beings, after all.
However, were I to try to fool a notary I wouldn't use my own bank. Every time I've gone there to notarize something, they pull up a signature specimen on their computer. Sometimes it's a scanned check image, once it was my original signature card (in digital form). Even when I'm out of state, the agent pulls up my computer records and compares my picture id to my account information and signature specimen. Much better to go to a notary who has no prior relationship to you like at a supermarket or check cashing establishment.
In Quebec (unlike the rest of Canada), the Notaries (not the lack of "Public") are a legal profession abilited to give legal advices, draft contracts, will and deal with real estates (in fact, the notaries basically perform all real-estate deals.) They are required by law to be impartial and provide equal legal advice to both parties. They're also required to insure that all parties signing a notarized documents fully understand its meaning and must provide legal advice if they don't.
The law degree here splits in the last year depending if they want to be a lawyer (and be able to represent someone in court) or a notary. Notaries must also belong to a professionnal association (Chambres des Notaires) and complete an articling and exams before being allowed to practice.
They must also keep all of their documents "in minutes" forever in a vault (when a notary dies or retires, his minutes passes on to another notary or to Quebec's National Archive.) We have records of practically all land deals for the last 400 years because of that.
"would a person (notary, TSA employee, airline ticket agent, etc.) really know a valid West Virgina license if they saw one"
I recall seeing some sort of poster or flyer showing sample driver licenses of all 50 US states. If I remember it right, it was intended for bar employees who needed to check IDs. I would expect the TSA to provide similar training/reference material to its employees.
To echo others: I've seen the same thing in Italy as others have in Spain, Greece, etc.
The US sets the bar very low for notaries. Back in college my roommate got his notary license, JUST so he could call himself "...noted notary public".
There's also a thing called a "signature guarantee", that only banks do. I think it's mostly used for doing stock transfers.
In the US the notary's job is to ensure the person signing the doc is who s/he says s/he is. As Bruce rightly points out, the notary's effectiveness is dependent on his/her alertness and the validity of the signer's ID. A related job is that of witness, whose fundemental function is to ensure the signature is unforced - a witness has no responsibility to ensure the signer's identity. The witness role is even more easily defrauded than the notary. The witness doesn't have to know the signer by sight and many witnessed documents don't ask for the witness' contact information.
Neither person has to read the document to perform his/her function. Nonethess, my experience is that many do, particularly the bank notaries. I don't know why and I wish they wouldn't.
Some banks won't allow their notaries to notarize highly sensitive documents such as wills. Again, I don't know why unless the bank doesn't want its employees pulled into potentially messy situations.
Just a comment from a notary about Bruce's original statement that Notaries don't read the document. That's not completely true. True, one function of a notary is to merely attest a signature. In those cases, Notaries are told that they should verify the document and that the signer knows what it is.
More importantly, one of the functions of a notary is to give oaths and execute documents where the signer is swearing under penalty of perjury as to the truth of the document. These require careful scrutiny to verify that the document is fully understood by the signer and that he/she is willing to swear to it.
The reason that I bring this up is it is not always immediately apparent which function the notary is being asked to perform. The notary would be foolish to assume the former merely on the word of the signer as the signer isn't expected to be legally trained and might not know the difference.
"Many important legal documents require notarization in addition to a signature, primarily as a security device."
Ah, that's where you are wrong. Notarization's actual function is as a signal to the signer that this is an Important Document. It is theater, not security.
There's also, under penalty of perjury, 28 USC 1746
Wherever..any matter is required or permitted to be supported, evidenced, established, or proved by the sworn declaration, verification, certificate, statement, oath, or affidavit, in writing of the person making the same...such matter may, with like force and effect, be supported, evidenced, established, or proved by the unsworn declaration, certificate, verification, or statement, in writing of such person which is subscribed by him, as true under penalty of perjury, and dated, in substantially the following form:
(1) If executed without the United States: “I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature)��?.
One thing that I wonder, just how difficult is it to forge a notary stamp? And how often is a notary's ID number on a document actually verified against the (I'm assuming this exists) central registry of notarys public? Of course, if you want to fraudulently notarize something, and it's not too horribly hard to forge the stamp, then I'd say you would probably only have to get a legitimate document notarized to "steal" the notary's ID number/name so that it would verify correctly.
It would seem to me that, for the most part, the protocol is built to be primarily verifiable/auditable, but I suspect that it is very seldom actually verified and audited unless there is a significant suspicion that something is amiss. A reasonably intelligent attacker will, by that time, already have absconded with his ill-gotten gains.
"Of course, this won't be enough if the final recipient of the document checks the signature; you're on your own when it comes to forgery."
That being the case, wouldn't it be easier to just get your own notary seal? It can't be that hard in the US.
Here is a real world example:
A "sample troll" forged George Clinton's signature to get the rights to his songs and is now suing artists that sample the popular George Clinton catalog (Parliament, Funkadelic, etc).
The contract was altered and then fraudulently notarized:
"3) Boladian fraudulently obtained a notarization upon the materially altered Agreement, and further altered the Agreement to remove qualifying language placed on the Agreement by the notary public, to overcome initial Copyright Office rejection;"
(from http://www.timwu.org/bridgeportjayz/... , also see http://www.timwu.org/bridgeportjayz.html )
This is all in play right now with a lawsuit against Jay-Z.
As an attorney in Indiana, I'm aware of several cases where notaries have been fooled. I'd have to say our state has a fairly weak system of notary training and guidelines/requirements.
It's not uncommon for notaries in Indiana to not keep logs, not check IDs, and to accept that a person signing a document is who she or he says he or she is.
I don't do that, but I must admit I don't keep logs of everything I notarize--probably because I do it so infrequently, and when I do, it's for people I know.
In Germany, probably similar to other European countries, the notary reads loud every single word of the contract in the presence of all signing parties. No one can claim he didn't know what was written. It is his duty to explain the meaning of the contract as well. Everybody needs to sign with the same signature as used in his ID document. The notary will sign the contract as well and will keep a copy of the contract, which is then stored at the local court. As another security measure the notary can't practice law at the same time. He is either a lawyer or notary. In fact it amused me quite a lot when I first saw what a notary public in the US or Latin America does.
I am not sure I would consider the situation described as social engineering as much as it just preys upon tendencies for human error.
as others have pointed out (Greece, Slovenia), in Italy being a notary public is a fulltime job, and a quite respectable and well paid at that (one could say that the well paid jobs there are medic and notary public). You need to be a lawyer and pass a state examination, and then you need to become one of a limited number (usually the job passes in family or by selling the 'license').
A Notary Public will pay attention to what is notarized, and often raise objections about legal validity if it contravenes existing legislation -- she will *certainly* read what is being signed.
That said, I find your points about Common Law Notary Publics being 'hackable' rather interesting - I had not thought of this one I must admit. Then again, if there is one thing in the US I like is that I can steer away from most such bureo-crap (In Italy, you would need a notary to sell a used car, for instance!)
In a different thought, I just wanted to also say that not every "security" measure in this world is meant or expected to result in complete security. This is especially true in cases of police presence or physical security. Do the police really expect and do we expect them to prevent, respond to, and investigate every single thing? No, otherwise there'd be a lot more policemen. Likewise with this situation. A notary and the process needed will deter a lot of people, as we do have a tendency to realize right vs wrong, and choose to avoid the wrong (would you speed more if you didn't see a policeman every now and then, or one waiting a few blocks up ahead?). Yes, you can beat the system and game it and get things notarized, but I don't know if anyone is truly having a fit that humans aren't doing their due diligence every single moment of their job or that this notary process is not foolproof and perfect.
If we truly thought this, we'd be eliminating humans from so many things...
What counts as a "government issued ID"? I attended a public university, is my student ID a government issued ID card? Now we are stuck not with 50 different IDs, but hundreds. How many people know what a Michigan Tech ID looks like? Add in all the public K-12 school districts issuing ID cards now and its thousands.
I seem to remember a story about "Martian League Diplomat" ID cards in one of your books. Been tempted to try something similar ever since.
This reminds me of Mark Russell's little song, done to the tune of "The Gambler", of "The Notary Public"... which focused on the problems when your stamping hand is worn out.
Like the Japanese stamps issued to each individual for life, they are no longer the absolute trust signature. Notary Public stamps are becoming the same.
"I recall seeing some sort of poster or flyer showing sample driver licenses of all 50 US states. If I remember it right, it was intended for bar employees who needed to check IDs."
I have personally used a published booklet which contained pictures of driver licenses / state ID cards, and details of what security features, such as holograms, should be visible. If there were variants for under/over 21, both were displayed.
a few more notes about the Russian customs in this regard.
The backdated out-of-town faked (but at $200-300 a very good one - paper is original and stamps are as good as original) general power of attorney is the very popular way of dealing with the inheritance matters.
yes, notaries, they are well-paid and the number of them does not increases, but people most of time takes notarized documents for granted, without further verifications. This leads for some easy crooky options in this security system.
As of verification, the more sophisticated do call notaries and verify if the document in question in fact has been notarized (notaries are required by law to keep a written logs of all transactions, including ID details of signatories). The stamp on the back of the notarized document with the "new phone number" of notary usually does the trick.
Another funny trick (working one) is to get a properly notarized power of attorney where A authorizes B to sell something. Then make a new one with the same numbers-stamps-dates with a small change that B authorizes A. Claiming that notary has been in hurry and simply wrote stuff wrong in her ledger works even in the court of law here.
Yes, some notaries even go to jail as a result of those strange operations. Rarely, but they do. But they are very very well paid, and this is the obvious risk of their profession, which they agreed to do to satisfy their greed.
The complete set of "tamperproof" stamps/seals of the real notary public can be had for $1500-2500. The equipment to make it cost around $30k-50k. The book describing the trade in details is another $30-50 from the bookshop. So, if it is something worth several millions to steal, this is a very cost-effective investment.
Laser printer, especially coupled with laser engraver is a most effective and dangerous weapon on the world, believe me.
International notarization (a.k.a. apostille) also allows for all those tricks, and even more. And you cannot always authenticate the transaction. Or crooky party can make sure you are unable to do it.
and IDs... your plastic ones are printed, and templates are available. substantial part of tamperproof state-issued documents are in fact quite workably tampered.
I hope this makes a good reading. Have a good day everyone.
I once went to a notary public with nothing but a copy of a will and got a notarized quitclaim out of it. The fact that I was cutting myself out of someone else's will apparently convinced the notary of my authenticity, as I was not asked for indentification.
Now, decades later, I wonder how many people have been cut out of wills by ringers?
Since I am a notary public here in Switzerland it was quite intersting to read your blog and the comments.
My education was 6 years of law school and where I live it is mandatory to have a law degree to become a notary.
We distinguish between different types of work: The legalization of signatures is just one (and probably the most boring one) type of work. Since we add not only a stamp but some written text with the persons data I doubt that your scam would work in my office.
Most of the signatures I legalize are the signature of long time clients and there I am sure that no fraud is involved. I often wonder if I would recognize a fake ID or not. I am not sure about that.
No need to fool a real notary to commit notary fraud. Just get a fake notary stamp. Get one with a real notary's name on it, or just make up your own. In this state, there's no number or other identifier, just a name and the date the notary's commission expires. I do real estate litigation for a large U.S. city government, and I've seen many, many documents with fake signatures and fake notary stamps that were recorded by the recorder's office and passed by title companies without anybody blinking an eye.
Unless fraud comes to light some other way, nobody ever checks that the notarization is valid. Ever. It's simply assumed to be self-authenticating, even though it's just a rubber stamp and a signature. There is no verification or validation.
How often does it happen? Often enough that nobody in my office is surprised by it, and we all know who to send it to at the detective division . . .
I live in Puerto Rico (USA) and travel to the mainland frequently on business. I usually rent a car.
Especially at smaller locations, I have had the counter agent pull out a big book that has not only the licenses for every state (and many foreign countries, I would bet) but also variations on the license. For example, the license format has changed several times over the past decade and the licenses are issued for 8 years. So my wife's license looks very different from mine and my son's is different again.
Its all there in the big book and if the license doesn't match, you don't get a car. (I assume)
Also, in PR notaries are required to be attornys although they do nothing more than verify the signature. But they charge $25 just for that.
I used to be a notary in Florida. No training is needed, and it costs about $100 for the 4-year duration of your "appointment" (the fancy word is that you are commissioned). The first term, I had one of those seal presses that wrinkles paper when you crimp it. The second term, I had a rubber stamp. My employer wanted me to become one, as going to the bank was too inconvenient for them. I felt queasy/hinky about it and ended up getting a lockbox to store the "seal" and coming to work one morning and being asked why the notary stamp was locked up since they paid for it.
Applications, in FL, to become notaries go through insurance companies who also sell you a bond/E&O insurance. The state requires a certain level of bond, many folks pay more. And the errors and omissions policy is in part to cover you if someone falsely represents themselves to you with false ID.
In FL, notaries can marry people, which is merely the act of notarising the back of a wedding license (needed both parties present) and mailing it back to the clerk of the court to register. The fancy stuff in the church is just for show, and the real marriage happens when the preacher/priest/minister notarises your wedding license.
In many other countries, a notary is close to an attorney. In FL, enough devious conmen played on this that they had regulations on foreign language advertising in FL. And there are plenty of foreign language communities in FL, not just Spanish.
There was plenty of risk, and very little "upside" in remaining a notary, and when my second term expired, I destroyed my stamp and seal and never looked back.
Interesting. I'm a NJ notary. To become it, I had to jump thru some hoops, pay a fee, buy some stuff, and **poof!** I was a notary for the next ten years. I did it to help the Libertarian candidates get thru another roadblock thrown by the incumbents. I do notarizations for my fellow employees. It's real easy since I require their Driver's License and and Employee Id. I have been called on to help divorcees, immigrants, foreign nationals, parents trying to adopt, car sellers, and even one fellow with a misspelled name on an airline ticket. I get each person's finger print to demonstrate that they appeared in front of me and I keep a logbook that seems pretty detailed. I try to help people get thru a lot of trivial administrivia. So hopefully it's a valuable service. And, I'm trying to make it "honest". Now, I'll put the entry number on the document when I sign. :-) Maybe I should scan the doc and create a digital hash?
Notaries in the UK are church officials and are appointed by the Archbishop of Canterbury. This tidbit can be a bit amusing when I have to have a document notarized for something in America.
I was surprised at how often I had to get documents notarised for what I thought were trivial reasons when I lived in the US. This ubiqutity possibly helps explain why 'muddles' can occur.
(Perhaps things are changing with UK Gov's mistrust of its people, but I can't think of a circumstance in 'normal' UK situations where a Notary would be needed.)
@Stephan Schwab - Is there an assumption that parties to a contract cannot read? I have heard from foreigners with much better German vocabulary than I, there is no requirement to ensure that the parties can understand what is being read out fast and loud by a German notary 8-)
Very interesting discussion as usual. BTW Wikipedia's article on 'Notary public' is remarkably comprehensive, including international comparisons. http://en.wikipedia.org/wiki/Notary_public
In Australia we have a 'Justice of the Peace' (JP) role which is clearly the equivalent of a US notary. This is something that a bank officer can sign up for, as an example. A notary here follows the UK model and can act in a range of formal legal roles - with authority (and responsibilities) more equivalent to a solicitor than a US notary.
Ah yes, I just noticed that the 'notary public' link in Bruce's article is to Wikipedia.
A little known and useless fact is that US military officers, being that we are authorized to administer oaths, mau also notarize documents.
It's useless because almost nobody knows this fact, therefore almost nobody accepts our notarization.
... American stock exchanges/brokers used to accept standard 'Notarized' owner-signatures on the back of normal paper stock-certificates for sale or transfer of those stocks.
They now do not accept such formally 'Notarized' signatures on stock-certificates. Apparently there was substantial fraud in that system.
In recent years they were forced to create their own system of "notarized' signature-authentication ... known as 'Medallion' certification.
You now can't sell typical paper stock-certificates unless you have an account with a commercial brokerage firm or bank that will guarantee your signature/ownership via this Medallion system. Previously, it was fairly easy & commonplace for average folks to sell paper stock shares with just a Notary-Public endorsement.
Looks like the U.S. 'Notary-Public' system is a government anachronism that should be radically overhauled or abolished.
fraud involving both real notaries and fake ones is rampant, but fingerprints in the logbook (thank you reinkefi) go a long way toward stopping it. this is required in some california counties for real estate transactions.
I just had to get a "notarized copy" of my passport. The system seems even more hackable since the notary simply creates and stamps a notarized copy cover sheet and staples i to the copy of my passport page. There is no stamp or mark of any kind made on the copy itself, and the cover sheet could easily be transferred to a completely different copy of someone else's passport or whatever.
It seemed so trivial to do something like that as to make the whole idea of a notarized copy stupid. I would have expected the copy itself to be stamped with one of those dies that shapes a seal into the paper so I couldn't swap the original document or make another non-notarized copy without losing the seal.
Seems like you might be able to use dual identities, one with notary rights, to notarize your own stuff. I don't mean split personalities, more like husband/wife, employer/employee (as pointed out above), etc.. All in all, Wikipedia indicates that the value of a notary seems to have been watered-down through the process of time until reaching an all-time low (most hackable) status in America.
"Qualifications vary from state to state, but states often bar people with certain types of criminal convictions and/or below a certain age from being appointed, and applicants usually must pass some type of relatively simple examination covering notary practices and law. The material for such exams is usually easily contained in a booklet. Some states also require a bond or insurance. Notaries in the United States are much less closely regulated than notaries in civil law jurisdictions or in most other common law countries, typically because U.S. notaries have less authority."
I had to get an affidavit (in Bangalore) signed by a notary a few months ago. The place where this is done is teaming with lawyers who'll solicit your business. You don't get to meet the notary, you don't get to go in--they have the access. The lawyer gets you the signature and you pay him. I'm thinking that the notary gets a cut as well.
You don't need social engineering, just a few hundred rupees and you can get documents notarized. Corruption is a great security breaker.
My state is the same as your state Bruce (Minnesota) -- And I'm a notary. (Just keep it handy for the occasional need at my job.) I was a bit worried when you claimed that I was supposed to be keeping a log...
The 'official register' is not required here, although it's considered a good idea. "Is a journal required? While Minnesota law does not require a journal, it is prudent of a notary public to keep one. The journal is to record all notarial acts performed, which could include the date and time of the act, the type of act, a description of the document, signature of each principal and circumstances for not completing a notarial act." From Minn Sec of State's FAQ on notaries. https://notary.sos.state.mn.us/InfoPage.aspx?pageid=7 See also Minn Stat ch 359 http://www.revisor.leg.state.mn.us/bin/...
the treasury dept. provides online access for buying and selling T-bills, bonds, etc. at least one of the methods requires you to submit a piece of paper (no electronic method is provided) countersigned by a bank officer if you want to change the account info, i.e. where the money goes. they explicitly say a notary is not acceptable.
As a state notary official for Oregon, I am both encouraged and dismayed by the comments on the list. There are so many misconceptions I'd like to clear up and so little space.
First, let me agree with Bruce that the security is largely dependant on the notary. That's by design. If there becomes a question about either the document or the notarization, the notary gets hauled into court.
This is not perfect security nor even very good security. It's based on the same principle of most legal and commercial transactions in the U.S. - 90% of transactions are good; don't let the 10% slow up the rest.
We assume a reasonable standard of care suffices for most actions. We want them to be carried out expeditiously. We don't want to have a single transaction take days or weeks or lots of expense to execute.
Notarizations outside the U.S. often have probative value - and you pay for that privilege. Here, we assume things are okay and then you pay when they aren't. I'm not saying one's better than the other, they're just different.
BTW, Bruce's notaries are pretty good. Notaries vary greatly in diligence, qualifications and abilities. States vary greatly in requirements. In Oregon, we require completion of an education course, a test, and each notarial act to be journalled. There are security measures to obtaining the seal. And we verify each notarization that is submitted to us for signature, capacity and status.
There are problems here, too. But, as legislators often say to me when I propose improvements on the laws, there aren't that many folks being harmed or they'd know about it.
There is way more notary fraud than ever gets caught by authorities. We try to put the fear of serious jail time in the hearts of all the notaries we train. However, there are several lazy or untrained notaries that are just looking to make a few dollars here and there. When you are dealing with a human institution, there are always going to be short-comings. As far as the ID from West Virginia (or any other state), we sell notaries the ID Checking Guide. Not everyone purchases one, but it is a great way to help the notaries determine fraudulent IDs.
I once commented to a lawyer specializing in signature law how weak the identity verification was in our notary process. He explained to me that that wasn't the point. The point as he saw it was that the act of having the signature notarized turned the forgery into a much more prosecutable crime than the forgery would have been on its own.
There are two types of Notary, the American type and the Roman Notary. Both very different.
You are right about the American Notary, not very secure.
But the Roman Notary works very differently.
Roman Notaries work together as a group. They know each other. They rely on knowing personally the people they are dealing with, or knowing someone they trust who can vouch for these people’s ID. Although not perfect, no other system could be more secure.
For example, if you wanted to buy a house from someone you do not know, you go to a Roman Notary ( which can be found in nearly every country ) and ask them to contact the Notary who sold the house to the current owner. That Notary will know that person very well as they were responsible for the previous conveyance. They probably know the owner’s family, their kids and were they grew up. They would certainly know what the real owner looks like and whether or not the house is really for sale. The Notaries then compare ID's to see if the person selling that house really is the owner. This is the system used in Italy for example and they have never had a property fraud using this system ( despite the existence of organized crime - which is probably why they have this system ). In Australia though, there is the American type system for checking ID's in property conveyance, and they have many property frauds every year.
It is sad that the Roman Notary is under pressure to be eliminated in Italy ( and elsewhere ) these days. In Australia ( and other places ) there is a lot of talk of introducing ID cards to protect IDs, but as you often say, this will not work and will be expensive. The real solution is the Roman Notary system. It's cheap ( despite the bad press from vested interests supplying the ID cards ) and it is as secure as it can get.
After all, the best way to know who someone is, is to know that person from when they where born. That's the basis of the Roman Notaries security model.
"Anyone know how often this kind of thing happens in real life?"
Well I do know that I committed notary fraud one evening. My company vehicle was towed for a parking violation in the city. I needed a company official to sign the release document and have the document notarized. This was at 7pm. Well we had a notary within the company... I went to his desk, found the notary embosser and went to work signing his name after practicing from other samples found in his work space.
The fraud allowed me to get home that evening, nothing more. In retrospect, it was way stupid. The risk vs. reward was way out of wack. No-one ever found out about it, to this very writing. Notary fraud... It happens and the whole system is stupid anyway.
If this system is even needed, the notary should be required to personally know you in order to sign. Otherwise, would it not be safer to provide two or three witnesses to your signature. Of course the witnesses would have to provide verifiable ID such as photocopy of drivers license etc.. and attest of personally knowing you for some length of time. Also, family should be excluded as witnesses.
I can't tell you what a huge sigh of satisfaction I heaved after reading the article about notary fraud. I am a notary in Los Angeles, California, authorized to issue marriage licenses on behalf of our County, and I am constantly frustrated and agitated about the countless notary transaction scams in this state and about how notaries are not given real tools for detecting fraudulent IDs (though we are charged with validating a signer's identity.) I am so happy that someone else NOTICED and spoke out about it.
> Anyone know how often this kind of thing happens in real life?
The National Notary Association (of which I am a reluctant member: http://www.nationalnotary.org/) publishes newsletters that are filled with articles about such things, as well as columns on notary malfeasance and how notaries are often made unknowing parties to unlawful notarizations (and how we can still be held liable in such situations.) In addition, the NNA peddles numerous products that are supposed to help notaries detect fake IDs; however, none of them will help where a signer has presented an false ID printed on an acceptable looking blank (with correct holographic images, for example) because notaries are not privy to the other validation codes used to identify fraudulent ID.
Here's a sad comparison: Many moons ago, I worked as a waitress in Washington State. Part of our training included information on how to detect fake IDs presented by underage drinkers. In WA, certain numbers in the driver's license number, when added to the last two years of the bearer's birth year, will total 100. If they don't, that means the license has been doctored. This actually turned out to be a viable "catch" in a few instances, was easy to calculate, and it didn't matter if the ID was printed on a stolen blank or not.
Now, I got this information as a WAITRESS. I am given NO such information as a NOTARY, a person who is charged (as the NNA constantly reminds us) with detecting ID fraud and preventing identity theft. The books the NNA proffers for sale show only the basic visual design of a driver's license (so yes, your banker/notary could have found out what a West Virginia driver's license looked like from one of these books) but there is no information on these other tricks that help detect tampering, nor is there any place a notary can go to ask about them.
Once when I approached my state DMV to ask them to validate a questionable ID they wouldn't do it, even though they could have given me a "yes" or a "no" without compromising any of the security codes or bearer's information. There are no authoritative resources if I am presented with a questionable ID document. Without any further training or information about ID security measures, notaries are pretty useless in determining ID fraud, and consequently it's fairly easy to get a valid notary stamp on a forged document with a fake ID.
Authentication gets even more complicated in my field, where one has be to careful to validate the NOTARY's authenticity as well as a signer's. L.A. County's authorizations to issue marriage licenses are sometimes revoked, so bad notaries find ways to purchase licenses from other authorized notaries, or to switch notary stamps with them to continue issuing licenses illegally. There's a huge trade in prison weddings, where the signers aren't even personally appearing in front of the notary as required because they can't, as well as phone weddings for military overseas, immigration/citizenship weddings, and a whole batch of other document fraud centered around unscrupulous notaries. L.A. County has recently initiated a computer registration of notary-issued marriage licenses that may help a little bit with tracking this activity and will give couples who get ripped off some back-up, but the County doesn't seem to have the money or the expertise to create a truly secure system for document issuance, and consequently loopholes are quickly and easily exploited by naughty notaries. I have an advisory on my webpage about some of these activities and spend a lot of time educating people about why verification matters, but many couples opt to take the easy (and often illegal) route.
I have made many complaints to the County and they sometimes sort of half-heartedly initiate a tepid "fix" but it's rarely anything that will be truly effective. Sigh.
am grateful to you for pointing out some of the weaknesses of the notary system to your readers. I hope that someday notaries will be given actual tools to detect ID fraud so we may better serve our citizens and government.
As a "notaio" in Italy, I am very much interested to compare with common law solution to the problem of legal trust.
In more than 80 countries around the world, "latin notaries" are trained lawyers, appointed by the State to give public faith to documents that can impair economic welfare of people. Therefore latin notaries bring large liability for their work; they are paid by interested parties (less than american homebuyers pay for title insurance) and not with public funds; furthermore, they collect taxes on transfers with no duty.
Oh, one more: you cannot receive as an inheritance, or "buy" the notary public title; much more complicated, you have to pass a very much complicated proof.
Not perfect, of course, but with this organization you can expect less than 0,0003% of faulty transactions.
What happens when a notary fails to sign a document but applied the seal?
There have been many instances that I have heard of where the Notary has applied the seal and forgot to sign the Jurat or acknowledgment. Somehow it still managed to get recorded at the court house. These particular Notarizations were on a deed of trust or mortgages depending on the state. Most of the time this is caught and sent back.
When governments and established institutions have taken to such large scale frauds there is no point in looking through lens at smaller things. This is the tragedy of modern times.
Dear Bruce Schneier, I live in Sydney, I have documents notarised which need to be serve on parties, the notary said show me the law that saids I have to serve these Documents, I have spent hundreds of dollars on 4 documents and I thought the payment would have been apart of the processing in serving these upon the parties listed within the documents, is this highway robbery, or because I don't know the proper wording to enforce the process, concerned patriot for the safety of my family, My budget is limited, Deborah
Last year I filed a complaint with the Florida notary division. My fathers house was in a trust and the lawyer who drew up the trust for a huge fee, removed the house from the trust through a quick claim deed that my father not only could not see, blind from cataracts, diagnosis of alzheimers (end stage supposedly)DID NOT SIGN. You can clearly see that it is not his signature!!!!There is one girl Heather Slager that supposedly runs the who department and would do nothing about it. Because the lawyer responded he was aware my father was having memory problems but says he signed it. If you know someone is having memory problems thats a red flag right there!!!!Then had the two witnesses back up his statement(secretary). Heather response to me was to pay for a hand writing analysis. She was afraid to do anything or step on any toes. Why should I have to pay for this??
I have a question. What is the legal significance of not having a notary present when signing a consent form? Is the consent form invalid? If the signature is not done before a notary, what implications are there, if any?
I never thought Notaries would give rise to such interesting discussions!
Is the Notary legally liable if a notarized document was not signed by the person required(in California)? What happends if the person who signed admits in court that he falsificate that signature and gave wrong information to the NOTARY to have him notarized this document?
My point is, Who is most responsible? Who will go to jail, or will have to pay for damages if any?
As a notary myself, I suggest that your notary social engineering plan may be less effective than you think.
If someone pesents an ID with which I am not familiar, I compare that ID to the "ID Checking Guide".
I also carefully check each document I notarize... so you are not going to get away with slipping a document with someone else's signature into a stack of your own documents.
However, if you don't like the idea of multiple IDs from different states, why do you oppose a single national ID?
How about offering a soultion to your notary security problem instaed of just complaining about it?
Oh Mogi, offering a solution to every problem isn't Mr. Schneier's job. This is a simple blog. Why don't YOU offer a "soultion"? If you think that Bruce has merely brought up the problems and has done nothing towards solving this security problem, if you can call it that, you miss the point, and it just serves to point out how utterly useless your post was. You didn't even try to use your brain.
GREAT ARTICLE AS FAR AS IT GOES
THE NOTARY IS NOT JUST IDENTIFYING THE SIGNER OR JUST WATCHING THEM SIGN
EVERY STATE LAW HAS FORMS OF NOTARY LANGUAGE CALLED CERTIFCATES THESE CAN BE ACKNOWLEDGEMENTS AND VERIFICATION ON OATH OR JURAT-PLUS OTHERS
THE NOTARY MUST ALSO HAVE THE PERSON MAKE AN ACKNOWLEDGMENT OR OATH DEPENDING ON THE LANGUAGE IN THE NOTARY CERTIFICATE
NOTARIES ARE NOT TAUGHT THE BASICS OF NOTARIZING BECAUSE THEY HAVE BEEN TOLD EITHER BY AN EMPLOYER OR ANOTHER NOTARY THAT ALL THEY ARE DOING IS VERIFYING SIGNATURES-
NOTARIES-READ YOUR STATE LAW
AND GET ALL THE TRAINING YOU CAN
THIS IS AN IMPORTANT LEGAL FUNCTION THAT CAN PREVENT FRAUD IF IT IS DONE CORRECTLY, BUT IF IT IS NOT, THE NOTARY MAY BE PERSONALLY LAIBLE FOR DAMAGES AND THERE IS NO DOLLAR LIMIT A PERSON CAN CLAIM-IT'S WHAT AMOUNT THEY THINK WILL COVER THE DAMAGES THEY SUFFERED.
READ THE ARTICLE ABOUT THE ALASKA GOVERNOR WHO HAD ETHICS CHARGES DROPPED IN PART BECAUSE THE DOCUMENT WAS INCORRECTLY NOTARIZED-SO YOU SEE THERE IS A LOT TO BEING A NOTARY, OTHERWISE WHY WOULD THERE BE A NOTARY LAW-AND IN MOST STATES A NOTARY BOND AND OPTIONAL INSURANCE TO PROTECT AGAINST LAWSUITS?
How do you file a claim against a notary when they notarize documents as favors knowing the person did not appear before them. I have a case where I lost thousands because my name was forged to a POA and my sister took my oil royalties!
When the notary answered the complaint, she actually forged the log. The names of the people she notarized documents for have their real signatures online on other docuuments, and you can tell the notary made up the log, as it was clearly in his handwrting. roaclaifiled The notary when answered
TO KAREN HARRIS
consult an attorney-this involves both a notary & your sister
My company in Wisconsin wants me to become a notary. I have a felony conviction from 20 years ago and am afraid I will not pass the requirements. If I purchase a notary stamp and sign my own name will I get caught? We need it for basic pay applications and waivers of lien.
call the state agency in wisconson that licenses notaries & ask them
I live in NJ, I just found out the my sister whos notary expired in 2006 appointed herself POA,Attorney in Fact and Gift Agent to my mother, and notarized it herself having her husband and another sister witness POA. I know my mother did not have a POA in 2009 so she back dated document to a month before her notary expired. Do you know what laws pertain to her notarizing a document with interest and not having any impartial parties witness said document?
to the nj person asking about the poa
you need an attorney there are several things wrong with what your sister did
I have a stamped, notarized document from a Notary Public in New York that includes her "No." How can I check to see if this license number is a valid one?
Your post was as enlightening as it was baffling but I can't say I'm shocked. In New York State, the only thing you need to do is pass a notary test, pay a fee, and buy a notarial stamp. Bam, you're a notary! The notary test is a huge joke; no actual important knowledge is tested. Although I took this test (hereafter "The Ridiculously Idiotic, Banal, Waste Of Time Test", or TRIBWOTT) many years ago, I remember most of the questions being incredibly banal: would-be notaries are expected to memorize things like "what is the maximum a notary can charge for an affidavit" but not to actually know what an affidavit is! To this date I don't know what an affidavit is. The first time I took the TRIBWOTT, I studied to understand what it is a notary is supposed to do and not do. The test does not cover anything regarding a notary's duties to prevent identity theft and does not even require notaries to understand how to notarize a document. Moreover, if you fail this banal waste of time, you can take it over, as far as I know, as many times as you need, which is exactly what I did after I failed it the first time, because instead of memorizing how many dollars I'm allowed to charge people for an apostille and whether Sundays are okay to notarize documents in New York, I tried to understand the whys and the hows. Silly me, next time I took it I took care to study only the banal details and passed with flying colours.
Furthermore, even though I myself take great care in my own notarizations and keep a log, I see faulty notarizations every single day from hundreds of NY notaries. The vast majority do not insert the required text before applying the stamp and signature, making their notarizations worthless. However, this makes perfect sense when the TRIBWOTT does not require notaries to know they have to do this. Many notarized documents I receive have one or many other of a plethora of errors, from a missing signature to a smudged stamp to an expired commission or what have you.
None of this would upset me too terribly if there was a central resource, either state- or country-wide, where notaries were required to register and where commissions could be checked and complaints could be filed. However, after months of on and off searching I have come to the rather remarkable conclusion that it does not, in fact, exist. How something so basic and common-sense could not exist in this country baffles me to no end. In fact, when I realized that such a resource did not exist, what surprised me was that anyone trusted notaries for anything at all, a stamp being nothing more than a fancy, $2 ink smattering. When I ordered my stamp, it was merely a matter of ordering it through an online retailer, just as one would order a book or a shoe. There was zero verification required: no name verification, no commission verification. I could order a notary stamp with my friend's name and a made-up number, forge their signature, perpetrate mass-scale notary fraud, and never get caught, because no one is checking who orders these stamps, and no one cares. It's a truly, truly scary thought that this system is so incredibly poorly designed and that it can be gamed so easily.
Anyway, I'm glad I found this small forum, where at least some other people have been thinking the same thoughts!
Any one can help for advise, phone number or any government agency contact? I need to report the notary fraud, because we never sign on any document but some one steel our ID and create the contract then we lost the house without sign or sell it. Please help me email@example.com.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.