From Ink To Encryption: Understanding E-Signature Risks in the Digital Banking Era

Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Amanda Knight (00:45):
Welcome to the Placing You First Podcast, where
we explore the issues andtrends shaping insurance.
I'm your host, Amanda Knight,joined by my co-host, Scott
Gordon.
And today we've got a greatepisode lined up.

Scott Gordon (00:57):
That's right, Amanda.
Today we're diving into a topicthat touches, well, nearly
every corner of the financialworld.
The shift from traditional wetsignatures, as they're called,
to digital and e-signatures.
What risks does that introduce?
And how can clients protectthemselves against these risks?

Well, and as more financial institutions move
operations online, we're allseeing tremendous benefits,
right?
Speed, convenience,accessibility, but that also
creates exposures andunderwriting considerations that
we have to think about.
So to help us unpack all ofthat, we're joined by Mark
Waldeck, professional linesbroker with CRC Chicago.

(01:38):
This is the Placing Your FirstPodcast from CRC Group.
This podcast features news andinsights from a vast knowledge
base of more than 5,500associates who write more than
30 billion in premium annually.

Mark Waldeck (02:02):
Mark, welcome back to the show.
Thanks for having me.
And this is obviously top ofmind uh a big item for a lot of
our clients.

Absolutely.
But you know, I can't say thatwhen you hear the word
e-signature, you're like, yes,let's talk about that.
So I duck up a little trivia,right?
A little a little bit of bitsand pieces to get us uh going
this morning.
Did you know?
And maybe you did, Mark,because you know a lot about
this.
Did you know that the veryfirst e-signature actually dates

(02:34):
back to 1869?
How you ask?
British courts ruled that atelegram could serve as a
legally binding agreement.
So basically the Victorianversion of DocuSign.
1896.
Who knew?
Take that to your next cocktailhour.

(02:56):
Um when do you think, Mark andScott, is the most popular time
of day for people to e-signdocuments?
Because there is indeed a mostpopular time of day according to
data.

I'd probably go with yeah, I'd go first thing in
the morning, but uh who knows?

Yes, I wake up and immediately think
e-signatures.
No, actually.
According to DocuSigns data,the most common time people sign
digital documents is around 3p.m.
local time.
Right after lunch, caffeinekicks in, inboxes get cleared.
So, you know, if you want torebel everyone, don't sign

(03:37):
anything at 3 p.m.
Pick another time of day.
All right, last one.
How many trees do digitalsignatures save?
All of them.
All the trees.
Going digital saves anestimated 2.5 billion sheets of
paper a year globally.
That's about 270,000 treessaved annually, thanks to

(04:01):
e-signatures.
So now that we're all a littlebit smarter onto the serious
stuff, Mark, you've been in thisgame a long time and you've
seen firsthand how banking andfinancial services have evolved
over the years.
Can you walk us through how wewent from signature cards all

(04:22):
the way now to digitalverification?

Yeah, it's it's a strange transition because um
banks have 100% embraced this,others have not.
So it really is the Wild West.
And I'd say the history behindit is uh that push for greater
convenience, uh fastertransactions makes perfect

(04:46):
sense.
Save the environment.
There's a million reasons whyyou should do it, but it comes
with risk that I believeeveryone is overlooked.

And the risk is (04:54):
do we make it somehow easier for the bad
actors to either impersonate thereal individuals that are
trying to effect a transaction?
And then what controls, if any,of has the bank considered that
should be inserted to preventthe bad actors from seizing

(05:15):
control?
So I think that's really thebig, you know, elephant in the
room that we have to figure outbecause digital signatures are
here to stay.
They're not going away, they'reonly going to get bigger and um
it's widespread use.
So now the function is how dowe make sure the insurance
contracts can keep pace becausethey're always playing catch-up?

(05:35):
And then how do we also makesure that the controls and
procedures are also uh revisedagain to reflect this new
environment?

Well, and you mentioned how big of an industry
this is from a marketstandpoint, it's huge.
Uh the digital signature marketis currently valued at over $12
billion as of 2025 and isgrowing at an annual rate of
about 26.5%.
That's massive.

And I think part of the part of the problem is
the competition that if a creditunion or a non-sanctioned
lender makes these um uhclosings easier, let's use a
real estate closing, well thenuh banks have to keep up or
they're gonna lose thatbusiness.
And that's the problem is youhave the sales side which is

(06:21):
pushing for this, but uh behindthe scenes, you have the audit
side or the control side that isprobably resisting.

It occurred to me, I mean, when we were talking
about the amount of trees save,it's not just the page that the
signatures on, it's all thosedocuments that come before it.
That's just page after pageafter page.
So I can see why it's goneaway.
Um I use digital signaturesevery day, but some people still
feel a little uneasy, Mark,about doing something as

(06:50):
important as say signing for aloan document online or
something.
Some say that uh digital issafer, while others are not uh
convinced.
So, how do you see thetrade-off between traditional
security and modern convenience?

I'm okay with our banks embracing it, provided
they have the infrastructurebacking it up.
And what I found within my ownbook of business is the majority
of the banks I interact with,they have decentralized
controls, which runs counter totheir organization.
Normally the way banks are setup, because they're so highly

(07:25):
regulated, you have to belicensed to open your doors.
So if they don't follow certainsafety and soundness procedures
and practices, regulators canshut them down.
They haven't really looked inthis area yet because we haven't
had a lot of claims, and we'llget to that later, but I believe
the challenge is getting thebanks to embrace a centralized

(07:48):
approach to okay, if we're gonnaaccept electronic signatures in
a remote environment, this ishow we're gonna do it, and we're
gonna do it the same way acrossall the silos or divisions
within the bank.
And what I'm finding is thelending area has their own set
of rules, the trust area has acompletely uh different set of

(08:09):
rules, etc.
That's the problem.
There's no consistency evenwithin the bank on how do we
address it.
And there's no regulatoryguidance.
The regulators haven't weighedin at all, which is frustrating.
But they're usually slow toreact, much like the insurance
industry.
We need a lot of losses orclaims, I think, to spur them to

(08:30):
act.

Well, and even at a more basic level, even you
know, from the consumer or theinsurance standpoint, there's a
lot of confusion aboute-signatures versus digital
signatures.
Can you clarify?
Because I would assume thatthose are the same thing, but
they're not.
So what is the differencebetween an e-signature and a

(08:51):
digital signature?

Um, I I can address that if you want.
The the uh it's the encryptionbehind it, the protection.
So uh what you want to makecertain is that there's some
type of encryption software thatwraps around uh the document
itself.
So that acts similar to a moator a barrier to keep the bad
guys away.

(09:14):
Um if you don't have thatbarrier, you make it very easy
then for them to see what you'resigning.
It makes it easy for someonewho wants to reproduce your
signature.
All those things become verysimple and easy for the hacker.

So even though both of these are legally
recognized, the level ofsecurity really depends on the
platform and the process.
Correct.

Um, and that's why, again, it's it's really the
Wild West.
Every time I go into a bank, Iget a different response and
answer from one bank to thenext.
And then even I was in a I waswith a bank in Colorado maybe a
few months ago, and I'm sittingin a room with their head of
commercial lending, the head oftheir trust area, their head of

(10:01):
IT, the CFO, and the CEO.
And I said, What's your currentstance on accepting digital
signatures, if at all?
And the CEO piped up right awayand she said, We don't ever do
it, we wouldn't consider it.
And the guy to her right said,Well, that's not entirely
accurate.
And I could just see the wholeroom was about to explode.

(10:23):
She's like, What do you meanwe're doing this?
But that's a great examplewhere some cases the bank
doesn't even know what the otherdepartments are doing.
So when I left that meeting,she said, We're not doing this
anymore.
And if we are, I want a writtenuh agreement that everybody in
the bank signs on to, not justlending, it could be any
department.
And I thought that was reallyeye-opening for me because it

(10:46):
highlights the fact that thedifferent silos don't talk to
each other.
And if we have a problem, it'sgonna be the same problem over
and over again within the samebank.
He hacked us in the lendingarea, he hacked us in treasury
risk management, he hacked us inuh the trust department.
It just goes on and on.
So I think the fear is for meto prove our loss with the

(11:08):
carrier, having that consistencywill go a long way in our
ability to trigger coverage.
If we lack that, we make itmuch easier, I think, for the
underwriters and the claimsadjusters to push it back and
say, well, you didn't even tryand prevent the loss.

You know, speaking of triggering coverage,
um, I actually saw this in thenews uh recently, Mark.
Um, and in an Indiana bank, Ibelieve it was, recently sued
its insurer after falling victimto a fraud scheme involving
someone in vel impersonating anNFL player.

(11:45):
Um, Scott, did you see that?

This is a true story.
Uh the bank, first farmers bankand trust, they made a
multi-million dollar loan tosomeone claiming to be Njoku,
assuming that's how youpronounce his name.
Uh the whole deal was doneremotely over Zoom, and
documents were uploadeddigitally.
Everything looked legitimate,and the notary even verified the

(12:10):
ID in person, but it turned outto be a complete identity theft
scam.

And the and the dispute with the carrier is you
needed to have the originaldocuments in the bank's
possession before you wouldclose and release the funds.
And the bank's defense, andit's gonna be litigated for a
long time, but the bank'sdefense was we went out of our
way to hire an independentnotary as our representative to

(12:38):
go to the remote location, sitwith the borrower, in this case
the fraudster, who waspretending to be the NFL player.
Um, so as far as I can see, itappears that the bank did
everything they could in theirpower.
So the only thing they probablylacked was physical possession
of the signature, but I wouldargue the notary did possess it.

(13:00):
And if that individual was yourdesignee, you can see where I'm
taking it.
The notary is no different thana bank employee.
It's he's that guy's just anindependent contractor.
So I think this is gonna uh gomany rounds in the court system
to try and unravel it.
And what I'm telling all mybanks is this is an example of a

(13:21):
three plus billion dollar assetbank publicly traded.
They tried to do the rightthing, and uh sending a notary
to a remote location is goingabove and beyond, and yet here
we are with coverage beingdenied.
And the big issue in the denialis you did not physically
possess those signatures at timeof closing and remittance.

(13:44):
And uh I think we have to sortof pay attention to what's going
on because the carriers aredealing with a policy form that
was written in the 1950s, andthey haven't, they're not sure.
In my opinion, the adjuster canonly go with what's inside the
boundaries of that margin of theof the policy, and they can't,

(14:05):
everything is silent, they can'tfind anything that that fits
perfectly into this scenario.
Uh, and when they set up someof these requirements, it
started with the physicalsignature cards, the physical
authentication.
We're not remotelyauthenticating you.
You have to be in the bank.
So uh what I'm cautioning allmy banks is let's not wait for

(14:29):
the other shoe to drop and thelawyers get involved.
Let's have the right controlsup front.
And then what I'm encouragingmy banks to do is let me upload
a copy with their permission ofyour procedures, not only to the
regulators, to your audit teamwithin the bank and to the
underwriter.
That way everyone's got it.
We've all agreed up front.

(14:50):
There shouldn't be anything toargue over, should there ever be
a claim.
Because I don't have confidencethat we can rely on our
individual underwriters to sortthrough this.
They're learning as we go.

So this is where the underwriting comes in
figuring out how to adapt thecoverage to reflect how business
is actually done today, right,Mark?

And we have endorsements.
Some of our underwriters willissue an endorsement for
electronic securities ore-signatures.
Um, but there's usually asublimit.
There may be a callbackrequirement.
You can accept this, but youneed to have a customer
agreement in file prior to anyof these real estate closings in

(15:32):
this example.
And you need to call thepre-arranged, pre-agreed um
number that's in that file.
So there's a million trapdoors,in my opinion, as you travel
down that path.
All of them end poorly for thebank unless they follow it to a
T.
So what I'm that's why I'mpushing the controls so hard.

(15:52):
If we can't demonstrate ourcontrols, we're gonna have a
hard time proving our loss.
So I think it's gonna startwith how do we authenticate?
What customer agreement is infile that allows a remote
transaction or an electronicsignature?
And then how do we, if we arein this remote environment, how
do we authenticate?
It all needs to be, I hate tosay it, codified up front.

(16:15):
Because if we don't, now we'refighting with the carrier and
the adjuster, and it's I thinkwe're gonna have a lot of angry
um clients because no two fraudsare the same, but I think the
biggest challenge will begetting the underwriter to sign
on to the controls that I willupload to them.

(16:36):
Hey, if you have a problem withour controls, speak now.
And if you're quiet, then I'mgonna take that as acceptance
that this is okay, and we're notgonna have a problem should
this scenario present.

Well, and working, I love I love when you refer to
them as your banks.
Because only King's CEOs andMark Waldeck can refer to them
legally as his banks.
I love it.
So for other listeners who workwith financial clients, Mart,
what are some top securitymeasures you recommend to reduce
e-signature risk?

Um I think the regular employee training is
critical.
Um, we definitely want to uhyou know carefully screen
whoever those key third-partyvendors are that we're relying
on, um, because that is a wholenother area of uh risk.
We don't control those thirdparties.
Um I think having thatsensitive data encrypted is

(17:30):
really, really important.
Uh, and that's both at rest andin transit.
Um, we talked aboutmulti-factor authentication and
having sort of that pre-agreedcustomer agreement in file.
Um I'm trying to think ifthere's any other ones.
We talked about the callback,some type of password
verification.
Um what I find though is thebigger the loan, the less

(17:56):
stringent the bank'srequirements are.
So that feels like if you wantto borrow $100,000.
Yeah, it's a lot of work andthey make you jump through
hoops.
But if you want to borrow fiveto ten million, they're lining
up to hand you the keys to thevault.
And I don't know why, butthat's just human nature.

Well, that's all great advice and a reminder, I
think, that customer experienceand security they can coexist.
We're not trying to makeanybody's life harder, but banks
really do have a responsibilityto balance both if we're going
to build trust and loyalty atthe same time.
So all right, Mark.

(18:33):
The hard parts behind you.
We've come to the best part.
Before we let you go, we knowwe always, you know, we always
like to end with a little fun.
Are you up for a few rapid firequestions?

Sure.

Okay.
All right.
The holidays are quicklyapproaching, or maybe they've
they've passed by the time ourlisteners are uh digging into
this episode.
But what is your favoriteholiday and why?

I'm probably gonna go with Thanksgiving, not just
because it's nearby on thecalendar, but it's it's easy,
there's no pressure.
Yes, all you gotta do is allyou gotta do is show up and eat,
and you don't have to get anygifts.

That's right.

Well, I'll come over to your house because
there's a lot of pressure overhere.
I'll tell you that.

No, I agree.
You just get to eat good foodwith people you love or like or
tolerate, depending on yourscenario.
And uh no gifts, no pressure,just wear your stretchy pants.

So, Scott, what would be your holiday if it's
not Thanksgiving?

Um, I you know, for an atheist, I really enjoy
Christmas and always have.
Um so yeah, probably Christmas.
Because I really like wrappingmy grandmother used to teach me
how to wrap presents, so it'slike my connection with her.
And plus, everyone wants me towrap their presents so that I
feel useful.

So I mean, can you wrap mine?
Because you can always tellwhen I wrap the presents because
it looks like a toddler did it.
I don't know.
You'd think it's not that hard,but it's that's my wife.

And my grandmother worked uh at Pizz department
store in the gift wrapdepartment back when they had
such a thing.
So she's a property.

She was a pro.

All right, Mark, next question.
What's one thing you alwayskeep in your briefcase?
Backpack or desk drawer?

Never leave home without it.

This is gonna sound weird, but I always bring
airborne.
I keep a tuba airborne, thefizzies in all of the above.
So if I'm on a plane andsomebody's hacking on me, I just
pound one of those and I'mfine.
Um I not that I'm a germ freak,but I'm just I don't have time.
So I'm running too fast.
So I just pop that stuff.

(20:34):
When we were when I wasoverseas a couple weeks ago, I
went to a pharmacy in France andasked in my broken French, I'm
looking for an airborne.
I showed them the two.
I said it's a fizzy, it goes inwater.
He sells me it's like a vitaminC chewable, but it's all in
French.
I drop it in a glass of water,it just sits there, it doesn't

(20:57):
dissolve, and I'm thinking,okay, he's he sold me the kind
you got the chewables.

So well, that's one way to get it.

But I'm I swear by that.

I you gotta have that effervescence.
Yeah.
And they also they taste good.
Sorry, I'm not doing an ad forairborne, but they're actually
pleasant for what it is.

Yeah.
And they do work.
I mean, I feel like they arehelpful in preventing getting
whatever funk is trapped withyou on the phone.
Right.

It doesn't hurt you.

Yeah.
Okay.
And most important questionwe've all established we're food
people.
What is your go-to Chicago deepdish spot?
If you're in Chicago, where areyou going?

That's a really good one.
Uh we have a lot of good deepdish pizza places.
I'd go Giordano's.
They're sort of the original.
And it's, you know, it's oneslice will put you to sleep.
You can't eat, you can't eatmore than one slice.
It's too thick.

Yeah.

It's good.

It's really good though.
It's worth every it's worthevery calorie.

Well, Mark, thanks for joining us again and
sharing your insights on digitaland e-signature risks.
It's pretty clear that this isan area with both opportunity
and exposure.
And the right guidance makes itmakes all the difference.

No, thanks for having me.
And uh I think there's a lot wecan do here at CRC to help our
clients and prospects.
And I think unlike a lot ofwholesalers, placement is just
one slice of this discussion.
And I think it's all the otherstuff that really uh makes all
the difference if a claim comesin.

Absolutely.
For more insights, visitCRCgroup.com.
You've been listening to thePlacing You First Podcast.
Be sure to follow and subscribewherever you get your podcasts,
and we'll see you next time.

All Episodes

Episode Transcript

Popular Podcasts

Stuff You Should Know

Dateline NBC

The Burden

.css-15opob5{left:0;position:absolute;top:0.8rem;} All Episodes

.css-14f5ked{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:2;overflow:hidden;}From Ink To Encryption: Understanding E-Signature Risks in the Digital Banking Era

Episode Transcript

Popular Podcasts

.css-r6mb8g{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:1;overflow:hidden;}Stuff You Should Know

Dateline NBC

The Burden

All Episodes

From Ink To Encryption: Understanding E-Signature Risks in the Digital Banking Era

Stuff You Should Know