Red Flags of a Docusign Scam Email

• No 32-Character Security Code: Legitimate Docusign notification emails always include a unique 32-character tracking code at the bottom.
• Suspicious Sender Domain: Official Docusign notifications only originate from emails ending strictly in @docusign.com or @docusign.net. Watch out for lookalikes like @docusign.yourcompany.com or completely random domains.
• Hidden Redirect Links: Hover your mouse over the "Review Document" button without clicking it. If the destination URL does not point directly to docusign.com or docusign.net, it is a trap.
• Urgent or Coercive Language: Fake emails often threaten legal action, account suspension, or financial penalties if you do not sign within a tight window (e.g., "within 14 days").
• Generic Greetings: Phishing attempts often use vague openers like "Dear Customer" or "Hello User" instead of your actual name.
• Unusual Attachments or QR Codes: Real signature requests use an embedded link, never HTML attachments, ZIP files, or QR codes to access documents.

Common Scam Variations

• The Fake Invoice/Refund: Scammers send a notification disguised as a major brand (like PayPal, Norton, or Geek Squad) claiming you owe money or are due a refund, trying to force you into a fake dispute process.
• OAuth Consent Phishing: The malicious link leads to a real Microsoft or Google sign-in page asking you to grant permissions to a third-party app named "DocuSign Service," allowing hackers into your email without needing your password.
• The Callback Trap: The message provides a fraudulent customer support number, pressuring you to call and verify a fake charge to extract your credit card data over the phone.

How to Safely Verify and Respond

1. Use the Security Code: Go directly to the official website at docusign.com. Click Access Documents at the top of the page, and paste the 32-character code from the email. If it is fake, the document will not exist.
2. Report the Phishing: Forward the malicious email as an attachment straight to verify@docusign.com. If the email came through an active Docusign envelope, click the built-in Report Abuse option in the message footer or web page.
3. Take Immediate Triage Steps: If you already clicked a link or entered your credentials, change your email and Docusign passwords immediately, enable Multi-Factor Authentication (MFA), and run a complete antivirus system scan.