# Fake DocuSign emails: how to spot e-signature phishing

URL: https://iblockspam.com/blog/fake-docusign-e-signature-phishing
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake DocuSign and e-signature emails work, including abuse of real DocuSign accounts, how to check an envelope with its security code, and how to report it.

## Short answer

Don't click Review Document in an unexpected signing request. Open docusign.com yourself, choose Access Documents and enter the security code from the bottom of the email. Real DocuSign notifications come from @docusign.net and never attach the document to sign. Forward fakes as an attachment to verify@docusign.com, and use Report Abuse for real envelopes sent by scammers.

"Please review and sign: Contract_Final.pdf." An e-signature request is one of the most believable emails a business receives, which is why criminals copy it. Some fakes only borrow the DocuSign logo. Others are sent through a real DocuSign account. This guide shows how to tell them apart without clicking, how to check an envelope safely, and where to report it.

## Why are e-signature emails so popular with phishers?

Signing requests have everything an attacker wants. They're expected at work, they carry a deadline, and the button says "Review Document", which feels harmless. Brands like DocuSign and Adobe Acrobat Sign are trusted, and staff in sales, finance, HR and property sign documents from strangers all the time.

Microsoft's threat researchers see the theme constantly. In its [Q1 2026 email threat report](https://www.microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights/), Microsoft described a large HTML attachment campaign whose subjects included "e-signature or document delivery requests", using "transactional framing to prompt recipients to review, sign, or access an attached document." Its [September 2026 report on device code phishing](https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/) lists "document signing services" first among the lure themes.

## What kinds of fake DocuSign emails are there?

| Type | How it's sent | What it wants | Passes email authentication? |
|---|---|---|---|
| Lookalike notification | From an unrelated or lookalike domain, with DocuSign branding | Your Microsoft 365 or Google password | Usually not as docusign.net |
| Spoofed DocuSign address | Forges a docusign.net or docusign.com address | Password or malware | Should fail DMARC at receivers that check |
| Attachment lure | HTML, SVG or PDF "document" attached | Password via a local fake sign-in page | Depends on the sending domain |
| Real envelope, fake sender | A scammer's own DocuSign account | Password, payment or personal data | Yes, it comes from DocuSign |
| Compromised partner | A real supplier's or client's mailbox | Anything | Yes, it's the partner's real mail |

The first three are imitations. Docusign's [fraud resources page](https://www.docusign.com/safety/fraud-resources) is clear that spoofed messages "do not originate from Docusign," even when they claim a docusign.net or docusign.com address.

The fourth is harder. Docusign's own [fraud guidance](https://www.docusign.com/blog/how-docusign-users-can-spot-avoid-and-report-fraud) says some fraudsters "signed up for legitimate Docusign accounts and used our services to appear reputable." That envelope really was sent by DocuSign. The document inside, or a link in it, is the trap.

## What are the red flags of a fake DocuSign email?

Docusign publishes several rules that make fakes easy to spot:

- **The sending domain isn't docusign.net.** Docusign says "envelope email notifications are always sent from the @docusign.net domain." A display name of "DocuSign" on any other address is a fake. Check the real address, not the name; our [display-name spoofing guide](https://iblockspam.com/blog/display-name-spoofing) explains the trick.
- **There's an attachment.** Docusign says emails "that request you to sign a document never contain attachments of any kind." A request with an HTML, SVG or PDF file attached is phishing. See why [HTML and SVG attachments are risky](https://iblockspam.com/blog/dangerous-email-attachment-types).
- **A pop-up appears in the email.** Docusign says it "never uses a pop-up box in an email."
- **No security code.** Most real notifications include one under **Alternate Signing Method** at the bottom.
- **The link goes somewhere else.** Hover over the button without clicking. Docusign advises this check and notes that a valid link may include a server prefix, such as "na2", "eu" or "demo". A link to a file-sharing site, a form builder or an unrelated domain is a fake.

And the general signs that apply to any signing service:

- **You weren't expecting a document**, or the sender is someone you've never dealt with.
- **The "document" asks you to sign in to Microsoft or Google.** A signing request has no reason to ask for your email password.
- **Vague or mismatched details.** A generic file name, "Dear user", or a company name that doesn't match the sender.
- **Pressure.** "Expires today", "Final notice" or a payment or bank-detail change hidden inside the agreement.

For a full annotated walkthrough of these signs, see [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email).

### A fake DocuSign email, annotated

> **From:** DocuSign Electronic Signature <notify@esign-docs-center.example>
> **Subject:** Completed: Please DocuSign: Payment_Remittance_Q4.pdf
> **Attachment:** Remittance_Q4_DocuSign.html
>
> You have received a document to review and sign. This document will expire in 24 hours. [REVIEW DOCUMENT]

- **The display name says DocuSign, but the address doesn't end in docusign.net.** That alone rules it out.
- **"Completed" and "Please DocuSign" in one subject.** Fakes often stitch together real notification phrases that don't belong together.
- **An HTML attachment.** Docusign doesn't attach the document to a signing request, and an `.html` file is a web page, not a contract.
- **No Alternate Signing Method section or security code** at the bottom.
- **A 24-hour deadline on a remittance you weren't expecting.** Money plus urgency is the oldest combination in phishing.

Now compare a real envelope sent by a scammer's own Docusign account. The sender address is at docusign.net, there's no attachment, and the security code works. What gives it away is the content: a sender you don't know, a document you weren't expecting, or a "document" that is really one page with a button asking you to sign in to view a file stored somewhere else. Treat that as phishing, and report it with **Report Abuse** rather than signing.

## How do you verify a DocuSign envelope safely?

The safest check doesn't use the email's links at all.

1. **Don't click "Review Document."** Leave the email open.
2. **Find the security code.** Scroll to the **Alternate Signing Method** section at the bottom of the email and copy the security code.
3. **Go to Docusign yourself.** Type docusign.com into your browser and select **Access Documents**. Docusign's [fraud resources page](https://www.docusign.com/safety/fraud-resources) describes this "Access Documents" feature as the way to open an envelope directly with its security code.
4. **Enter the code.** If it opens the document, the envelope exists in Docusign.
5. **Now judge the content.** A real envelope can still come from a scammer. Is it the document you expected, from a person you know? If you're unsure, contact the sender by a phone number you already have. The [FTC's advice](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams) is to "contact the company using a phone number or website you know is real."
6. **Never enter your email password** to view a document. If a page asks for it, close it.

The same approach works for Adobe Acrobat Sign, Dropbox Sign and other services. Sign in to the service's site directly, or ask the sender to confirm, rather than trusting the email.

## What do you do if you clicked or signed in?

If you only opened the email, delete it and report it. If you clicked and entered a password, act now:

1. **Change the password you typed** from a trusted device. Usually it's your Microsoft 365 or Google Workspace password. If it was your Docusign password, change that too.
2. **Tell IT straight away.** They should revoke your sessions, remove any MFA method you didn't add and check for new inbox rules. Our guide to [fake Microsoft login pages](https://iblockspam.com/blog/fake-microsoft-login-phishing) covers the admin steps for Microsoft 365.
3. **Report the email** (see below).
4. **If you downloaded and opened a file**, disconnect from the network and tell IT before doing anything else.

The full checklist is in [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).

## How do you report a fake DocuSign email?

Docusign separates imitation emails from abuse of its real platform. Its [Safety Center](https://www.docusign.com/safety) gives these routes:

| Situation | Where to report |
|---|---|
| Email that imitates Docusign | Forward the entire email **as an attachment** to `verify@docusign.com`, then delete it |
| Suspicious website or link | Copy the URL into an email to `verify@docusign.com` |
| Real envelope from a suspicious sender | Use **Report Abuse** (the three vertical dots in the signing screen) or the **Report this email** link in the notification footer |
| No access to the envelope | Use Docusign's Report Abuse form, linked from the Safety Center |

Docusign's current Safety Center lists `verify@docusign.com` as the place to forward suspicious Docusign emails.

Docusign also notes that it "does not contact law enforcement on behalf of a potential fraud victim." If you lost money, contact your bank and report it to the [FBI's IC3](https://www.ic3.gov) in the US.

Inside your organization, use your mail app's report button too. Our guide to [reporting a phishing email](https://iblockspam.com/blog/report-phishing-email) covers Outlook, Gmail and Apple Mail.

## How can a business reduce e-signature phishing?

### Make the safe path the normal path

- Tell staff to open signing requests by going to the service directly or using the security code, every time.
- Agree with regular partners how documents will arrive, and who will send them.
- Never approve a payment change that arrives inside a signing request without a callback. See [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).

### Use filtering and authentication

- **Block or quarantine HTML and SVG attachments** that don't need to arrive. Real signing requests don't carry them.
- **Check impersonation.** Inbound filtering should catch "DocuSign" display names on non-Docusign domains and lookalike domains.
- **Honor DMARC.** Receivers that enforce the sender's DMARC policy reject mail that forges Docusign's own domains.
- **Tag external mail** so a "document from your CEO" sent from outside stands out.

### Protect the accounts the fake pages target

Most e-signature phishing is after an email password, not a Docusign one. Phishing-resistant MFA, such as passkeys or security keys, stops a stolen password and code from being replayed. See [AiTM phishing and MFA bypass](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass).

## Next steps

1. Share the four-step check with your team: no attachments, docusign.net sender, security code via Access Documents, and a real person behind it.
2. Make sure your mail filtering quarantines HTML and SVG attachments and flags brand impersonation.
3. Add `verify@docusign.com` and your internal report button to your phishing reporting guide.
4. Use the free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see which domain really sent a suspicious request. If you want domain-level filtering in front of your mailboxes, see [how iBlockSpam works](https://iblockspam.com/how-it-works).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How do I know if a DocuSign email is real?

Don't use the email's buttons. Go to docusign.com yourself, select Access Documents and enter the security code from the Alternate Signing Method section at the bottom of the email. If the code opens a document you expected, from a sender you know, it's real. Docusign also says its envelope notifications always come from the @docusign.net domain.

### Does DocuSign send attachments?

Not with a signing request. Docusign says its emails that ask you to sign a document never contain attachments of any kind. You review and sign on the Docusign site instead, so an HTML, PDF or SVG file attached to a request to sign is a strong sign of phishing.

### Can scammers send real DocuSign envelopes?

Yes. Docusign says some fraudsters have signed up for legitimate Docusign accounts and used its service to appear reputable. Those envelopes come from Docusign's real servers and pass email authentication. Judge them by the sender and the content: an unknown sender, a document you didn't expect, or a link to sign in elsewhere means stop.

### Where do I report a fake DocuSign email?

Docusign's Safety Center says to forward the entire email as an attachment to verify@docusign.com and then delete it. For a real envelope sent by a scammer, use the Report Abuse option in the signing screen or the Report this email link in the notification footer. Also report it to your IT team and through your mail app.

### I entered my password after a DocuSign email. What should I do?

Usually the fake page asked for your Microsoft 365 or Google password, not a Docusign one. Change that password at once from a trusted device, tell IT so they can revoke your sessions and check for new MFA methods and inbox rules, and report the email. If you entered a Docusign password, change that too.

## Sources

- [Docusign Safety Center: Fraud resources](https://www.docusign.com/safety/fraud-resources)
- [Docusign Safety Center](https://www.docusign.com/safety)
- [Docusign blog: How Docusign Users Can Spot, Avoid and Report Fraud](https://www.docusign.com/blog/how-docusign-users-can-spot-avoid-and-report-fraud)
- [Microsoft Threat Intelligence: Email threat landscape, Q1 2026 trends and insights](https://www.microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights/)
- [Microsoft Threat Intelligence: Unmasking EvilTokens, getting to the root of device code phishing (September 2026)](https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/)
- [FTC: How to Recognize and Avoid Phishing Scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-docusign-e-signature-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt