Introduction

In the Philippines, electronic contracting is no longer exceptional. It is routine. Businesses approve contracts by email, employees acknowledge policies through HR platforms, borrowers accept digital loan terms through mobile applications, banks authenticate transactions by electronic means, and private persons increasingly use scanned signatures, typed names, one-time passwords, click-wrap acceptance, and platform-based e-sign tools in daily dealings. As electronic transactions became normal, a difficult legal question also became unavoidable: who bears liability when an electronic signature is used without authority?

This issue sits at the intersection of several Philippine legal regimes: the Electronic Commerce Act, its implementing rules, the Rules on Electronic Evidence, the Civil Code, agency law, banking and payment law principles, the Data Privacy Act, cybercrime legislation, criminal fraud doctrines, labor law issues, corporate authority rules, and evidentiary presumptions in litigation. In practice, “unauthorized electronic signature” can refer to many situations: a forged digital signature, a typed name placed without consent, a click-to-accept made by another person, misuse of a corporate officer’s credentials, a hacker-triggered approval, an employee using a superior’s account, a borrower denying an app-based loan acceptance, or a family member completing a bank transaction using the account holder’s device.

Philippine law does not treat all these situations the same way. Liability depends on the type of electronic signature, the source of the authority claimed, the security method used, the relationship between the parties, the allocation of contractual risk, the evidence available, and whether the case is analyzed as a matter of civil enforceability, administrative breach, or criminal wrongdoing.

This article explains the Philippine legal framework in depth.

I. What Is an Electronic Signature in Philippine Law?

The legal starting point is that Philippine law recognizes that a signature need not be handwritten in ink to be legally significant. An electronic signature, in general terms, is any electronic data logically associated with an electronic document and adopted by a person with the intention of authenticating or approving it.

This broad idea includes many forms, such as:

a typed name at the end of an email;
a scanned handwritten signature pasted into a PDF;
clicking an “I agree” or “accept” button;
checking a consent box on a platform;
entering a one-time password;
using a PIN, password, or biometric approval method;
using cryptographic or certificate-based digital signatures.

Not all electronic signatures have the same evidentiary strength. Philippine law is functionally flexible: it allows electronic methods to be valid, but validity and enforceability turn on whether the method is reliable, attributable to the correct person, and appropriate for the purpose for which the document was generated or signed.

That is why unauthorized electronic signature disputes are usually not just about whether an e-sign exists, but whether the e-sign can legally be attributed to the person against whom it is invoked.

II. The Central Legal Question: Attribution

In unauthorized electronic signature cases, the true issue is almost always attribution.

Attribution asks: Can this electronic act be legally treated as the act of the person whose name, account, credential, or identity appears on it?

A signature may appear on a screen, in a file, or in a transaction log. That alone is not enough. Philippine law looks to whether the signature or electronic act was:

actually made by that person;
made by a person with authority to act for that person;
made through a system controlled by that person under circumstances that justify attribution;
adopted, ratified, or later accepted by that person;
or instead produced through fraud, mistake, coercion, system compromise, credential theft, or unauthorized use.

Liability turns on this attribution analysis.

III. Main Sources of Philippine Law

Unauthorized electronic signature liability in the Philippines is shaped by a cluster of laws and rules rather than one single statute.

A. Electronic Commerce Act

The Electronic Commerce Act gives legal recognition to electronic data messages, electronic documents, and electronic signatures. Its importance lies in rejecting the idea that a transaction is unenforceable merely because it is electronic.

But recognition is not the same as automatic validity. The Act also assumes the need to evaluate reliability, integrity, and attribution.

B. Implementing Rules and Regulations of the E-Commerce Act

The implementing rules elaborate how electronic signatures may be treated as functionally equivalent to handwritten signatures, especially where the method used identifies the signatory and indicates assent, and is reliable for the purpose.

These rules matter in unauthorized signature disputes because they focus attention on the method of authentication and whether it is sufficiently dependable.

C. Rules on Electronic Evidence

In litigation, this is crucial. The Rules on Electronic Evidence govern how electronic documents, electronic signatures, ephemeral communications, business records, and related proofs may be admitted and evaluated in court.

An electronic signature dispute often rises or falls on evidence such as:

metadata;
server logs;
email headers;
audit trails;
IP addresses;
device identifiers;
SMS records;
OTP confirmations;
timestamps;
access-control records;
certificate information;
platform logs;
and witness testimony explaining the system.

D. Civil Code of the Philippines

The Civil Code governs contracts, consent, obligations, fraud, damages, negligence, agency, estoppel, ratification, and unauthorized acts. Even if a document is electronic, the classic civil law rules on consent and authority still apply.

E. Special laws depending on context

Depending on the facts, unauthorized e-signature cases may also implicate:

the Cybercrime Prevention Act;
the Revised Penal Code provisions on estafa, falsification, and fraud-related conduct;
the Data Privacy Act;
banking and payment system regulations;
corporate law rules on authority of officers and agents;
labor law in employment-related approvals;
consumer law in app-based contracting;
and sector-specific compliance rules.

IV. What Counts as “Unauthorized”?

An electronic signature is unauthorized when it is used without valid authority from the person to whom it is attributed. That sounds simple, but authority can fail in different ways.

A. No authority at all

This is the clearest case. Someone uses another person’s electronic signing tool, account, email, password, OTP, or digital certificate without permission.

Examples:

a hacked corporate email account sends contract approval;
a spouse uses the account holder’s phone to approve a loan;
an employee copies a superior’s signature image into a PDF without permission;
a fraudster enters stolen credentials to authorize fund transfers.

B. Exceeded authority

A person may have some authority, but not enough for the transaction involved.

Examples:

an assistant may send routine correspondence but not sign contracts;
a branch employee may process applications but not approve loans;
a finance officer may approve purchases only up to a fixed amount;
an HR officer may circulate documents but not execute settlement agreements.

In these cases, the signature is not wholly fabricated, but it may still be unauthorized as to the disputed act.

C. Authority withdrawn or expired

A person may once have been authorized but no longer is.

Examples:

a resigned officer still has access to a signing platform;
an employee’s credentials remain active after termination;
a former project lead continues to approve change orders;
an agent signs after revocation of authority.

D. Apparent but not actual authority

This is one of the hardest cases. The signer may not truly have authority, but the circumstances may have led the other party reasonably to believe that authority existed. Here, liability may shift through agency law, negligence, or estoppel.

E. System-generated acceptance without real consent

Sometimes the dispute is not about a person physically signing, but about a system claiming acceptance through a click, OTP, or app workflow that the alleged signatory denies making. The question becomes whether the system is reliable enough to support attribution.

V. Types of Electronic Signature Disputes in Practice

Philippine unauthorized e-signature problems usually fall into recurring categories.

1. Forged signature image

A handwritten signature is scanned and inserted into an electronic document.

This is visually persuasive but legally weak if challenged, because a pasted image alone proves little about who placed it there or whether authority existed.

2. Typed-name signatures

A person’s name is typed at the end of an email or contract template.

Typed names may constitute valid signatures in some settings, but they are easy to deny. The dispute then depends on surrounding evidence such as account ownership, email practices, prior dealings, and response history.

3. Email authorization disputes

A contract or instruction is allegedly approved by email.

Key issues become:

who controlled the email account;
whether the account was compromised;
whether the style, context, and timing are genuine;
whether the recipient reasonably relied on the message;
whether follow-up conduct ratified it.

4. OTP, PIN, or password-based approvals

In banking, fintech, and platform environments, the system may treat OTP entry or credential use as electronic signature or authentication.

Here the argument often becomes:

did the user actually receive and enter the OTP;
was the phone compromised;
was the user tricked through phishing;
was the bank or platform negligent in its security;
did the user share credentials or act carelessly.

5. Digital certificate misuse

Where cryptographic digital signatures are used, the technical sophistication is higher, but unauthorized use is still possible if private keys are stolen, devices are compromised, or credential governance is poor.

6. Employee and corporate workflow misuse

A subordinate uses a superior’s account, token, or stored signature in an internal approval chain.

These cases often involve mixed liability: the rogue employee may be directly liable, while the organization may also face liability for poor access control.

7. Online lending and consumer app acceptance disputes

A borrower denies accepting loan terms, arbitration clauses, fees, consent waivers, or privacy permissions attributed to a mobile app session.

The lender then must prove the reliability and integrity of the electronic acceptance process.

VI. Validity of Electronic Signatures Does Not Eliminate the Need for Consent

A persistent mistake is to think that because electronic signatures are legally recognized, any electronic indication of assent is automatically enforceable.

That is not correct.

Under Philippine law, consent remains essential. The electronic form merely changes the medium. It does not abolish the requirements of:

genuine assent;
identity of the actor;
lawful authority;
absence of fraud or mistake;
and adequate proof.

An unauthorized electronic signature is therefore not saved by the mere fact that it appears in a recognized electronic format.

VII. Civil Liability: Who Bears the Loss?

Civil liability in unauthorized electronic signature disputes depends on the interaction of contract law, negligence, agency, estoppel, and evidence.

A. Liability of the person who actually used the unauthorized signature

The direct wrongdoer may be liable for:

damages for fraud;
indemnity for losses caused;
return of money or property obtained;
breach of confidential or fiduciary obligations;
and possibly criminal exposure.

But identifying the wrongdoer is often difficult, especially in remote fraud cases.

B. Liability of the person whose name or account was used

The alleged signatory is not automatically liable merely because the signature or approval bears their name or account credentials. Liability depends on whether the act can legally be attributed to them.

However, that person may still bear loss where:

they negligently shared passwords, OTPs, or signing access;
they failed to secure private keys or authentication devices;
they allowed others to habitually use their account;
they failed to promptly report compromise;
they created an appearance of authority on which others reasonably relied;
they later ratified the transaction;
or their conduct amounts to estoppel.

C. Liability of the relying party

The party who accepted the electronic signature may bear the loss where they failed to exercise reasonable diligence.

Examples:

accepting a large transaction with weak authentication;
ignoring obvious red flags in an email approval;
failing to verify unusual instructions;
using insecure signing processes;
relying on a pasted signature image for high-value obligations;
processing approvals despite discrepancies in identity data.

In other words, reliance must also be reasonable.

D. Liability of intermediaries, platforms, or service providers

Where an e-sign platform, fintech operator, bank, employer, or software vendor maintained the system used, liability may arise if there was:

poor security design;
deficient access control;
inadequate logging;
lack of revocation procedures;
weak authentication for high-risk actions;
negligent credential recovery process;
or failure to detect obvious fraud indicators.

The precise liability depends on contract, regulation, negligence standards, and the platform’s role.

VIII. The Role of Negligence

In Philippine disputes, unauthorized electronic signature liability often becomes a negligence case rather than a pure forgery case.

The court may ask:

Who was in the best position to prevent the misuse?
Who failed to observe ordinary diligence?
Was the security method appropriate to the transaction’s risk?
Was there unreasonable trust in weak authentication?
Did any party ignore warning signs?
Was there delay in reporting unauthorized use?
Were controls proportionate to the amount involved?

This matters because even where consent was absent, losses may still be allocated based on negligence.

Examples of negligent conduct by the alleged signatory

sharing email passwords with staff;
leaving signing tokens accessible;
storing signature images in common folders;
allowing assistants to “just handle” approvals without formal delegation;
sharing OTPs during phone calls or chats;
failing to update access after employee resignation.

Examples of negligent conduct by the relying party

processing high-value transfers on the basis of a single unverified email;
failing to call back for confirmation on unusual payment instructions;
relying on screenshots instead of secure workflow logs;
accepting inconsistent ID records;
ignoring system alerts or failed authentication anomalies.

IX. Agency, Apparent Authority, and Estoppel

This is one of the most important doctrines in Philippine commercial practice.

A signature may be unauthorized in a strict internal sense, yet still bind a principal if the principal’s conduct created the appearance that the signer had authority and the other party relied in good faith.

A. Actual authority

Actual authority may be express or implied. If it exists, the electronic signature binds the principal even if the principal later regrets the deal.

B. Apparent authority

Apparent authority arises when the principal’s conduct leads a third party reasonably to believe the agent has authority.

Electronic settings can easily create this issue. For example:

the company allows an officer’s email account to be used for contract execution patterns;
the business routinely accepts purchase orders approved through a certain platform login;
the principal lets an assistant sign electronically over time without objection;
internal titles and workflows suggest authority externally.

C. Estoppel

A person may be estopped from denying authority if their own conduct misled others. This can happen where a business:

tolerates insecure signature practices;
fails to correct known misuse;
accepts benefits under the disputed transaction;
or delays repudiation after learning of the transaction.

D. Ratification

Even if a signature was unauthorized at the start, the principal may later ratify the act, expressly or impliedly.

Implied ratification may arise when the principal:

accepts payment or benefits;
performs part of the contract;
fails to promptly disavow after knowledge;
or behaves consistently with affirmance.

Once ratified, the act may bind the principal as though originally authorized.

X. Burden of Proof and Evidence

Unauthorized electronic signature cases are evidence-heavy. Philippine courts do not decide them merely by intuition. The party asserting enforceability must usually prove that the electronic signature is attributable and reliable enough to bind the other side.

A. What the proponent of the signature typically must show

that the document exists in reliable form;
that the signature or approval process identifies the alleged signatory;
that the method indicates assent;
that the system was functioning properly;
that logs and records were preserved;
that access control made misuse unlikely;
that the transaction trail supports authenticity.

B. What the denying party typically tries to show

account compromise;
credential theft;
absence of authority;
tampering;
weak or non-exclusive access controls;
irregular metadata or timestamps;
deviation from ordinary business practice;
prompt repudiation;
lack of benefit or ratification;
internal rules limiting the signer’s authority.

C. Important forms of evidence

In Philippine litigation, useful evidence may include:

original electronic files;
audit logs;
email server records;
system screenshots with authentication history;
device-registration data;
OTP delivery logs;
telecom records where available;
IP and geolocation logs;
login timestamps;
certificate records;
witness testimony from IT administrators;
internal policies on authority;
board resolutions or delegations;
incident reports;
forensic examination results.

A printed screenshot alone may be far less persuasive than a full authenticated system trail.

XI. The Difference Between Simple Electronic Signatures and Digital Signatures

Not all e-signs are equal in evidentiary force.

A. Simple electronic signatures

These include typed names, clicks, emails, scanned signatures, checkbox acceptance, and ordinary credential-based approvals. They can be valid, but their strength depends heavily on surrounding evidence.

B. Digital signatures in the cryptographic sense

These involve technical methods using keys and certificates to authenticate the signer and protect document integrity. Properly implemented digital signatures are generally stronger evidence because they better support identity linkage and tamper detection.

Still, they are not infallible. Liability issues remain possible where:

private keys are compromised;
token custody is weak;
certificate revocation is mishandled;
insiders misuse credentials;
endpoint devices are infected or stolen.

A more sophisticated method raises the evidentiary bar, but it does not end the inquiry.

XII. Banking and Financial Transactions

Unauthorized electronic signature disputes are particularly serious in banking, digital payments, and financial platforms.

A. Typical disputes

unauthorized fund transfers;
loan availment disputes;
online banking approvals;
wire or payout instructions sent by compromised email;
e-wallet withdrawals;
unauthorized credit or facility activation.

B. Core liability questions

These cases often turn on:

whether the account holder shared credentials;
whether phishing or social engineering occurred;
whether the bank used commercially reasonable security;
whether alerts, confirmation calls, or risk flags were ignored;
whether the transaction pattern was abnormal;
whether the customer promptly notified the institution.

C. Allocation of loss

There is no single universal answer. A customer may bear loss if grossly negligent. But a bank or platform may bear liability if its controls were weak or if it processed suspicious transactions without adequate safeguards.

High-trust institutions are generally expected to exercise a high degree of diligence in handling funds and authentication systems.

XIII. Corporate and Commercial Transactions

In Philippine corporate practice, many contracts are approved through email, board platforms, PDF execution tools, or delegated digital workflows. Unauthorized e-signature disputes often involve questions of corporate authority.

A. Who may bind the corporation?

Not every employee or officer may bind the corporation to every contract. Authority may come from:

law;
the articles or by-laws;
board resolutions;
office functions;
express delegation;
customary practice recognized by the corporation.

B. Internal limits matter, but not always against outsiders

A corporation may internally limit an officer’s authority. But if it outwardly clothes the officer with apparent authority, the corporation may still be bound to a third party acting in good faith.

C. Signature workflow and corporate governance

A corporation that uses electronic signature systems should define:

who may sign;
monetary thresholds;
document classes;
multi-factor approval requirements;
revocation rules;
emergency override procedures;
board reporting;
audit retention.

Where these controls are absent, unauthorized acts become much harder to contest.

XIV. Employment Context

Unauthorized electronic signatures also arise in labor and HR settings.

Examples include:

forged acceptance of resignation;
fabricated acknowledgment of company policies;
unauthorized execution of quitclaims or waivers;
fake payroll approvals;
misuse of an employee’s portal credentials.

These cases are sensitive because labor adjudicators examine not only technical authenticity but also the reality of consent and fairness. A weak electronic process may not support a supposed waiver, quitclaim, or disciplinary acknowledgment if the employee credibly denies assent.

Employers should not assume that a checkbox or typed name will automatically defeat an employee’s challenge.

XV. Consumer and Platform Transactions

E-commerce platforms, subscription services, fintech apps, and online lenders often rely on click-wrap and sign-up workflows.

A. When these are generally enforceable

They are strongest when:

terms are presented clearly before acceptance;
the user must affirmatively act;
records show the account owner’s involvement;
the system logs acceptance reliably;
the terms are not hidden or deceptive.

B. When liability becomes difficult to enforce

Problems arise where:

the terms were buried or inaccessible;
the user claims account takeover;
device-sharing is common;
identity verification was minimal;
the platform cannot produce dependable logs;
sensitive permissions or waivers were bundled opaquely.

In disputes over unauthorized acceptance, platform operators need more than bare assertions that “our records show acceptance.”

XVI. Data Privacy and Unauthorized Electronic Signature Misuse

Unauthorized electronic signature incidents often involve personal-data breaches.

Examples:

stolen IDs used for e-sign onboarding;
unauthorized access to a signing dashboard;
email compromise exposing contracts and credentials;
platform breaches allowing impersonation;
contact-list misuse in app-based lending;
leaked certificate files or identity documents.

Under Philippine privacy principles, an organization that processes personal data must implement appropriate organizational, physical, and technical security measures. If poor security enabled the unauthorized signature event, privacy liability and regulatory exposure may arise alongside contract and fraud claims.

Data security is not separate from e-sign validity. In modern systems, they are deeply connected.

XVII. Criminal Liability

Unauthorized electronic signature use can also trigger criminal exposure depending on the facts.

Possible criminal theories may include:

fraud or estafa;
falsification-related conduct;
identity misuse;
unlawful access or hacking;
computer-related fraud;
illegal interception or misuse of credentials;
privacy offenses where data was unlawfully processed or disclosed.

Criminal liability does not automatically determine civil enforceability, but the same facts often support both a criminal complaint and a civil claim for damages.

A key point is that mere denial of an electronic signature does not by itself prove a crime. Criminal liability requires proof of the specific offense charged.

XVIII. What Happens if the Signature Was Unauthorized but the Transaction Benefited the Denying Party?

This is a hard case.

Suppose a person denies an electronic signature but undeniably accepted the benefits of the transaction. Or a corporation denies an officer’s e-sign but retained the goods, used the software, or received the funds.

In these situations, the dispute may shift from signature validity to:

ratification;
unjust enrichment;
implied contract;
restitution;
estoppel.

A party cannot always reject the signature while keeping all benefits without consequence. Courts may fashion relief even if the original signature authority was defective.

XIX. Prompt Repudiation Matters

A person who learns of an unauthorized electronic signature should act promptly.

Delay may harm the denial because it may suggest:

acquiescence;
ratification;
poor credibility;
or failure to mitigate loss.

Prompt steps usually include:

immediate notice to the counterparty;
password and credential changes;
account suspension;
incident documentation;
internal investigation;
preservation of logs and devices;
reporting to the platform, bank, employer, or service provider;
and, where appropriate, police, cybercrime, or regulatory reporting.

Silence after knowledge can become legally expensive.

XX. Contract Clauses That Allocate E-Signature Risk

Many modern contracts attempt to allocate the risks of unauthorized electronic signature use. Clauses may state that:

use of a designated email is deemed authorized;
acts through a registered device are binding;
OTP use conclusively evidences consent;
parties bear responsibility for safeguarding credentials;
electronically signed copies are as binding as originals;
notices sent to specified channels are deemed received.

These clauses are important, but they are not unlimited shields. Philippine law may still examine:

unconscionability;
fairness;
reasonableness;
consumer context;
gross negligence;
fraud;
public policy;
and whether the clause actually fits the facts.

A contract cannot always erase the consequences of an obviously insecure or abusive authentication process.

XXI. Litigation Issues in Philippine Courts and Tribunals

In a Philippine dispute, a party challenging or defending an electronic signature should expect the case to focus on system reliability and factual detail.

Important litigation themes include:

1. Preservation of electronic evidence

Failure to preserve logs, original files, devices, and audit data can be fatal.

2. Authenticity and integrity

The court will ask whether the electronic record remained intact and whether tampering is likely.

3. Testimony from technical witnesses

IT administrators, compliance officers, records custodians, and forensic experts may be necessary.

4. Ordinary course of business

Business practice matters. A transaction inconsistent with normal workflow is easier to challenge.

5. Comparative credibility

Courts often compare narratives:

Was the denial prompt and consistent?
Was the reliance commercially reasonable?
Were controls proportionate to the amount and risk?

XXII. Practical Liability Scenarios

To understand the doctrine, it helps to see how liability may differ across fact patterns.

Scenario 1: Assistant signs boss’s contract using stored PDF signature

The boss denies authority. The counterparty knew the boss usually signed personally and noticed irregular wording. Liability may fall on the assistant, and the boss may not be bound if no authority, ratification, or estoppel is shown.

Scenario 2: Company lets procurement head use a signing platform for months

The procurement head signs a supply agreement beyond internal limits. The supplier relied in good faith on the established process. The company may be bound through apparent authority, even if the officer exceeded internal instructions.

Scenario 3: Customer shares OTP with scammer after a phishing call

The customer challenges an online transfer. The bank’s liability depends on whether its security and warnings were adequate, but the customer’s negligence may significantly affect loss allocation.

Scenario 4: Corporate email compromise causes false payment instruction

A vendor relies on unusual new bank details sent from a known company email. If the vendor ignored red flags and failed verification, the vendor may bear loss. If the company had abysmal email security and tolerated weak controls, liability may be contested or shared depending on facts.

Scenario 5: Borrower denies app-based loan acceptance

The lender must show device binding, KYC integrity, log trail, consent flow, disclosure presentation, OTP or biometric trail, and fund disbursement linkage. Without robust logs, the lender’s position weakens substantially.

XXIII. Compliance Measures to Reduce Liability

Philippine organizations and individuals can materially reduce unauthorized e-signature risk through disciplined controls.

A. Governance controls

define who may electronically sign and for what;
impose approval thresholds;
use delegation registers;
revoke access immediately upon role changes.

B. Technical controls

multi-factor authentication;
secure device binding;
role-based access control;
digital certificate management;
encryption and secure storage;
tamper-evident audit trails;
anomaly detection;
session monitoring.

C. Process controls

callback verification for unusual transactions;
dual approval for high-value actions;
separate authorization and payment release roles;
documented incident response procedures.

D. Documentary controls

maintain authority matrices;
preserve board resolutions and delegations;
archive electronic evidence;
retain logs in accessible and defensible form.

E. Training

phishing awareness;
credential hygiene;
OTP discipline;
rules against signature sharing;
prompt reporting obligations.

F. Contract hygiene

clear e-signature clauses;
designated communication channels;
incident notice rules;
commercially reasonable authentication methods fitted to transaction risk.

XXIV. Best Legal Principles to Remember

Several Philippine legal principles emerge repeatedly in unauthorized electronic signature disputes.

1. Electronic form is valid, but attribution must still be proved

Recognition of e-signatures does not remove the need for real consent or authority.

2. Reliability of the method matters

The stronger and more secure the authentication system, the easier attribution becomes.

3. Negligence can shift loss

Even without true consent, careless handling of credentials or careless reliance may alter liability.

4. Apparent authority and estoppel remain powerful

A principal who creates the appearance of authority may be bound despite internal defects.

5. Prompt repudiation is essential

Delay can look like ratification.

6. Evidence decides most cases

Audit trails, logs, system records, and consistent behavior matter more than broad assertions.

7. Context matters

A consumer click, a bank transfer, a board resolution, and an HR waiver are not judged identically.

XXV. Final Analysis

Unauthorized electronic signature liability in the Philippines is not governed by a single simplistic rule such as “electronic signatures are always valid” or “electronic signatures are easy to deny.” The real legal inquiry is whether the electronic act can be reliably and fairly attributed to the person or entity sought to be bound.

Where authority is absent and the electronic act is the product of forgery, hacking, impersonation, or misuse, the signature should not automatically bind the named signatory. But the analysis does not stop there. Liability may still be shaped by negligence, apparent authority, estoppel, ratification, platform security failure, contractual risk allocation, and the quality of electronic evidence.

In the Philippine setting, the most defensible approach is to treat electronic signatures as legally real but technically fragile unless backed by strong controls. For individuals, businesses, banks, fintech companies, employers, and online platforms, unauthorized electronic signature disputes are won or lost not only on formal law, but on the discipline of identity management, access control, disclosure, documentation, and evidence preservation.

The governing lesson is straightforward: in Philippine law, an unauthorized electronic signature is not merely a technology problem. It is a problem of consent, authority, attribution, and proof.