Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Docusign Scam Email - How to Protect Yourself
Docusign Scam Email - How to Protect Yourself

If you receive an unexpected email asking you to review or sign a document via Docusign, do not click any links, open attachments, or call any phone numbers listed in the message. Cybercriminals frequently run sophisticated phishing scams by impersonating Docusign or abusing its platform to steal your login credentials, install malware, or trick you into paying fake invoices.

Red Flags of a Docusign Scam Email

  • No 32-Character Security Code: Legitimate Docusign notification emails always include a unique 32-character tracking code at the bottom.
  • Suspicious Sender Domain: Official Docusign notifications only originate from emails ending strictly in @docusign.com or @docusign.net. Watch out for lookalikes like @docusign.yourcompany.com or completely random domains.
  • Hidden Redirect Links: Hover your mouse over the "Review Document" button without clicking it. If the destination URL does not point directly to docusign.com or docusign.net, it is a trap.
  • Urgent or Coercive Language: Fake emails often threaten legal action, account suspension, or financial penalties if you do not sign within a tight window (e.g., "within 14 days").
  • Generic Greetings: Phishing attempts often use vague openers like "Dear Customer" or "Hello User" instead of your actual name.
  • Unusual Attachments or QR Codes: Real signature requests use an embedded link, never HTML attachments, ZIP files, or QR codes to access documents.

Common Scam Variations

  • The Fake Invoice/Refund: Scammers send a notification disguised as a major brand (like PayPal, Norton, or Geek Squad) claiming you owe money or are due a refund, trying to force you into a fake dispute process.
  • OAuth Consent Phishing: The malicious link leads to a real Microsoft or Google sign-in page asking you to grant permissions to a third-party app named "DocuSign Service," allowing hackers into your email without needing your password.
  • The Callback Trap: The message provides a fraudulent customer support number, pressuring you to call and verify a fake charge to extract your credit card data over the phone.

How to Safely Verify and Respond

  1. Use the Security Code: Go directly to the official website at docusign.com. Click Access Documents at the top of the page, and paste the 32-character code from the email. If it is fake, the document will not exist.
  2. Report the Phishing: Forward the malicious email as an attachment straight to verify@docusign.com. If the email came through an active Docusign envelope, click the built-in Report Abuse option in the message footer or web page.
  3. Take Immediate Triage Steps: If you already clicked a link or entered your credentials, change your email and Docusign passwords immediately, enable Multi-Factor Authentication (MFA), and run a complete antivirus system scan.
waiting