Fake DocuSign emails: how to spot e-signature phishing

"Please review and sign: Contract_Final.pdf." An e-signature request is one of the most believable emails a business receives, which is why criminals copy it. Some fakes only borrow the DocuSign logo. Others are sent through a real DocuSign account. This guide shows how to tell them apart without clicking, how to check an envelope safely, and where to report it.

Why are e-signature emails so popular with phishers?

Signing requests have everything an attacker wants. They're expected at work, they carry a deadline, and the button says "Review Document", which feels harmless. Brands like DocuSign and Adobe Acrobat Sign are trusted, and staff in sales, finance, HR and property sign documents from strangers all the time.

Microsoft's threat researchers see the theme constantly. In its Q1 2026 email threat report, Microsoft described a large HTML attachment campaign whose subjects included "e-signature or document delivery requests", using "transactional framing to prompt recipients to review, sign, or access an attached document." Its September 2026 report on device code phishing lists "document signing services" first among the lure themes.

What kinds of fake DocuSign emails are there?

The first three are imitations. Docusign's fraud resources page is clear that spoofed messages "do not originate from Docusign," even when they claim a docusign.net or docusign.com address.

The fourth is harder. Docusign's own fraud guidance says some fraudsters "signed up for legitimate Docusign accounts and used our services to appear reputable." That envelope really was sent by DocuSign. The document inside, or a link in it, is the trap.

What are the red flags of a fake DocuSign email?

Docusign publishes several rules that make fakes easy to spot:

• The sending domain isn't docusign.net. Docusign says "envelope email notifications are always sent from the @docusign.net domain." A display name of "DocuSign" on any other address is a fake. Check the real address, not the name; our display-name spoofing guide explains the trick.
• There's an attachment. Docusign says emails "that request you to sign a document never contain attachments of any kind." A request with an HTML, SVG or PDF file attached is phishing. See why HTML and SVG attachments are risky.
• A pop-up appears in the email. Docusign says it "never uses a pop-up box in an email."
• No security code. Most real notifications include one under Alternate Signing Method at the bottom.
• The link goes somewhere else. Hover over the button without clicking. Docusign advises this check and notes that a valid link may include a server prefix, such as "na2", "eu" or "demo". A link to a file-sharing site, a form builder or an unrelated domain is a fake.

And the general signs that apply to any signing service:

• You weren't expecting a document, or the sender is someone you've never dealt with.
• The "document" asks you to sign in to Microsoft or Google. A signing request has no reason to ask for your email password.
• Vague or mismatched details. A generic file name, "Dear user", or a company name that doesn't match the sender.
• Pressure. "Expires today", "Final notice" or a payment or bank-detail change hidden inside the agreement.

For a full annotated walkthrough of these signs, see how to spot a phishing email.

A fake DocuSign email, annotated

From: DocuSign Electronic Signature <notify@esign-docs-center.example> Subject: Completed: Please DocuSign: Payment_Remittance_Q4.pdf Attachment: Remittance_Q4_DocuSign.html

You have received a document to review and sign. This document will expire in 24 hours. [REVIEW DOCUMENT]

• The display name says DocuSign, but the address doesn't end in docusign.net. That alone rules it out.
• "Completed" and "Please DocuSign" in one subject. Fakes often stitch together real notification phrases that don't belong together.
• An HTML attachment. Docusign doesn't attach the document to a signing request, and an .html file is a web page, not a contract.
• No Alternate Signing Method section or security code at the bottom.
• A 24-hour deadline on a remittance you weren't expecting. Money plus urgency is the oldest combination in phishing.

Now compare a real envelope sent by a scammer's own Docusign account. The sender address is at docusign.net, there's no attachment, and the security code works. What gives it away is the content: a sender you don't know, a document you weren't expecting, or a "document" that is really one page with a button asking you to sign in to view a file stored somewhere else. Treat that as phishing, and report it with Report Abuse rather than signing.

How do you verify a DocuSign envelope safely?

The safest check doesn't use the email's links at all.

1. Don't click "Review Document." Leave the email open.
2. Find the security code. Scroll to the Alternate Signing Method section at the bottom of the email and copy the security code.
3. Go to Docusign yourself. Type docusign.com into your browser and select Access Documents. Docusign's fraud resources page describes this "Access Documents" feature as the way to open an envelope directly with its security code.
4. Enter the code. If it opens the document, the envelope exists in Docusign.
5. Now judge the content. A real envelope can still come from a scammer. Is it the document you expected, from a person you know? If you're unsure, contact the sender by a phone number you already have. The FTC's advice is to "contact the company using a phone number or website you know is real."
6. Never enter your email password to view a document. If a page asks for it, close it.

The same approach works for Adobe Acrobat Sign, Dropbox Sign and other services. Sign in to the service's site directly, or ask the sender to confirm, rather than trusting the email.

What do you do if you clicked or signed in?

If you only opened the email, delete it and report it. If you clicked and entered a password, act now:

1. Change the password you typed from a trusted device. Usually it's your Microsoft 365 or Google Workspace password. If it was your Docusign password, change that too.
2. Tell IT straight away. They should revoke your sessions, remove any MFA method you didn't add and check for new inbox rules. Our guide to fake Microsoft login pages covers the admin steps for Microsoft 365.
3. Report the email (see below).
4. If you downloaded and opened a file, disconnect from the network and tell IT before doing anything else.

The full checklist is in what to do after clicking a phishing link.

How do you report a fake DocuSign email?

Docusign separates imitation emails from abuse of its real platform. Its Safety Center gives these routes:

Docusign's current Safety Center lists verify@docusign.com as the place to forward suspicious Docusign emails.

Docusign also notes that it "does not contact law enforcement on behalf of a potential fraud victim." If you lost money, contact your bank and report it to the FBI's IC3 in the US.

Inside your organization, use your mail app's report button too. Our guide to reporting a phishing email covers Outlook, Gmail and Apple Mail.

How can a business reduce e-signature phishing?

Make the safe path the normal path

• Tell staff to open signing requests by going to the service directly or using the security code, every time.
• Agree with regular partners how documents will arrive, and who will send them.
• Never approve a payment change that arrives inside a signing request without a callback. See vendor invoice fraud.

Use filtering and authentication

• Block or quarantine HTML and SVG attachments that don't need to arrive. Real signing requests don't carry them.
• Check impersonation. Inbound filtering should catch "DocuSign" display names on non-Docusign domains and lookalike domains.
• Honor DMARC. Receivers that enforce the sender's DMARC policy reject mail that forges Docusign's own domains.
• Tag external mail so a "document from your CEO" sent from outside stands out.

Protect the accounts the fake pages target

Most e-signature phishing is after an email password, not a Docusign one. Phishing-resistant MFA, such as passkeys or security keys, stops a stolen password and code from being replayed. See AiTM phishing and MFA bypass.

Next steps

1. Share the four-step check with your team: no attachments, docusign.net sender, security code via Access Documents, and a real person behind it.
2. Make sure your mail filtering quarantines HTML and SVG attachments and flags brand impersonation.
3. Add verify@docusign.com and your internal report button to your phishing reporting guide.
4. Use the free Email Header Analyzer to see which domain really sent a suspicious request. If you want domain-level filtering in front of your mailboxes, see how iBlockSpam works.

Browse our other phishing and threat guides.