DocuSign Scam Email: How to Spot a Fake

What a DocuSign Scam Email Looks Like

A DocuSign phishing email usually asks you to trust an unexpected document or act before you’ve checked who sent it. Some imitate the service, while others misuse a real account.

These are hypothetical examples of how the scam could reach a mortgage brokerage:

• A fake invoice says you’ve already signed for a subscription and must call the number supplied to cancel a charge. DocuSign reports this invoice-and-phone-call tactic in its fraud resources.
• A supposed settlement document asks your client to sign immediately and transfer funds to replacement bank details. Call the known settlement contact using a number already on file before anyone pays.
• A “view loan documents” button opens a copied login page that asks for an email password or authentication code. Close the page and contact the supposed sender independently.

Treat a document containing an external QR code or a download to “unblur” its contents as suspicious. DocuSign warns that attackers place malicious links inside envelopes as well as in emails.

How to Tell a Real DocuSign Email From a Fake

Check whether the request belongs to an actual transaction, then inspect the message without using its links. Have the client’s expected lender or document sender confirm the request through an existing contact channel.

1. Expand the sender’s address. A display name saying “DocuSign” proves nothing. DocuSign says envelope notifications come from its docusign.net domain, but spoofing and account abuse mean that address alone doesn’t establish trust.
2. Inspect the link destination without opening it. On a computer, hover over the button. A lookalike hostname or unrelated destination is a warning, and a padlock only describes the connection’s encryption.
3. Check the envelope ID with the sender. DocuSign’s envelope documentation describes this as the identifier for the document package. Ask the known sender to match it to the request they issued. A number printed in an email isn’t proof by itself.
4. Access the expected document independently. Type docusign.com into your browser, choose “Access Documents” and enter the security code under “Alternate Signing Method” in the email. Use that security code, rather than assuming the envelope ID is the same field.
5. Check the document against the confirmed request. The sender, borrower and document purpose must match what the client expects. Stop if the document diverts you to another login page, an unexpected payment or a software download.

If the code is missing or rejected, ask the known sender to confirm or resend the request through their usual process. Don’t return to the suspicious button to bypass the problem.

Only proceed once the sender has confirmed the request and the independently accessed document matches it. Confirm any changed payment instructions by phone through a previously trusted number.

Is DocuSign Safe?

Yes, DocuSign is a legitimate electronic signing platform with security controls for documents and account access. Scammers copy its branding because signing requests are familiar, and they can also misuse the legitimate platform.

The DocuSign Trust Centre describes application-level 256-bit encryption and encrypted data transfers. It also lists configurable multi-factor authentication and a digital audit trail with a Certificate of Completion.

For document integrity, the Trust Centre says each document is “intact and tamper evident”. Those controls help protect the signing process and its records. You still need to establish who requested the signature and whether the contents are authorised.

What to Do If You Clicked

Close the suspicious page and tell your brokerage’s IT or security contact what happened. Explain whether you entered credentials, approved a sign-in, downloaded a file or sent money, because each needs a different response.

If you only opened the page, stop interacting with it and report the message. If you downloaded or ran a file, contact IT immediately and use a separate trusted device for account recovery.

If you entered a password or approved an unexpected sign-in, follow these steps:

1. Change the affected account’s password through its official website or app on a trusted device. Change any other account where you reused that password.
2. Sign out other sessions and review recovery details. Ask IT to inspect the account for unauthorised access and email forwarding rules.
3. Turn on two-factor authentication, also called multi-factor authentication (MFA). Never approve an unexpected sign-in or share a one-time code.
4. Warn the client and the lender through known contact details if their documents, accounts or transaction could be affected. Tell the settlement contact immediately if payment instructions were involved.
5. If money was sent or banking details were exposed, call the bank immediately using its official number. Ask it to secure the account and attempt to stop the transfer.

The Australian Cyber Security Centre’s email attack response guide covers securing compromised accounts and warning contacts. Record the account changes and any suspicious activity so your IT team can confirm recovery.

Report a DocuSign Phishing Email

Report suspicious DocuSign messages to the platform and use Australia’s reporting channels for the scam or resulting crime. Preserve the original message and headers for your security team before removing it from the inbox.

1. Forward the suspicious email as an attachment to verify@docusign.com. DocuSign’s fraud alerts give this address for suspicious messages. Your email application’s “forward as attachment” option preserves the message for investigation.
2. Use your workplace’s phishing-reporting process. If you’ve accessed the envelope independently on DocuSign’s site, its signing experience also has a “Report Abuse” option.
3. Submit the contact through Scamwatch’s report form, even if nobody lost money. Include the sender and what the scam asked you to do.
4. If someone stole personal information or money, make a police report through ReportCyber. Keep the reference number with the incident record.

Tell your client which signing request is genuine and how they’ll receive its replacement. Resume the loan-document process only after the known sender confirms the document and any affected payment instructions.