And when should you use them?
Former FBI Director Robert Mueller once said: “There are only two types of companies: those that have been hacked, and those that will be.”
No company is immune to cyber-attacks or fraud. And more than ever, it is important to ensure the right controls are in place to protect against fraud. Particularly against electronic signature fraud when signing contracts and important documents remotely for industries like the financial sector. Online fraud is becoming more common today due to people staying at home during the coronavirus pandemic, without the additional protection of corporate network security for example.
With digital fraud on the rise, now is a good opportunity for businesses to take responsibility with a signing process that prioritizes their clients’ personal security, without the need for complex identity checks.
Enter Advanced Electronic Signatures (AES) and Qualified Electronic Signature (QES).
Under the eIDAS (Electronic Identification, Authentication and Trust Services) regulation, the three types of electronic signatures – Standard, Advanced and Qualified – are all legally valid.
Standard Electronic Signatures have been available for many years. However, they have not generally been used for complex high-risk transactions and contracts, such as loans or insurance. This can be a signature manually drawn on a desktop screen or scanned handwritten signatures. But you cannot be certain that the signature is linked to the signer, because it is no more than just a ‘scribble on a screen’. This can raise some challenges in relation to security. Is the person really who they say they are?
An Advanced Electronic Signature and a Qualified Electronic Signature, on the other hand, provide a higher level of security. This is because they use a digital signature, i.e. protecting the signed document by cryptographic means.
Both formats of electronic signatures have the following properties:
To put it briefly, a Qualified Electronic Signature is an Advanced Electronic Signature that meets additional requirements.
With a QES, a qualified certificate is needed to attest to the authenticity of an electronic signature and serve as proof of the identity of the signatory. The signature itself must also be created using special hardware and software, known as a Qualified Signature Creation Device (QSCD). This ensures that:
While Simple Electronic Signatures and Advanced Electronic Signatures both have their place, QES provides the strongest legal evidence when it comes to disputes over digital transactions, for example, and can help to protect both the consumer and the business against fraud.
In some countries, like Belgium, it is in many cases mandatory to use a QES when it comes to signing documents digitally. But in other countries, choosing an electronic signature is mainly based on choice and risk assessment.
When the risk is low, or an acceptable small risk, consider Standard Electronic Signatures or AES. It all boils down to trust. For example, if you are getting documents signed internally within a company, but you still need to identify people. If something went wrong, then it shouldn’t have a huge impact, as it is happening within the company.
QES can be more costly and complex to use. However, if the risk is high or serious, then a QES should be used. For example, when signing documents that require a witness or contracts that require execution under seal. It is, of course possible to add Long-Term Validation to any of the signatures (ES/AES/QES). This means the signature can be validated into the future.
However, if you don’t know the person or company you are dealing with, QES can provide the highest level of security. Under eIDAS, it ‘provides the highest level of admissibility in the EU courts and has the equivalent legal effect of a handwritten signature’.
According to award-winning science fiction writer, William Gibson, “the future is here, but it’s not evenly distributed.”
COVID-19 may just be the push companies need to start thinking about the technology that is available to help make their lives less difficult. And by using AES or QES, you can bring great rewards to your business, including efficiency and security.
Read our in-depth guide to Qualified Electronic Signatures to learn more.
John Erik Setsaas
VP of Identity and Innovation at Signicat
July 02 2020