Fake DocuSign email: "document to sign"

"You have received a document to sign." "Please review and sign this contract." "Invoice awaiting signature." These messages copy DocuSign, a widely used e-signature service. Scammers like it because a document to sign looks normal, especially at work.

How the scam works

1. You get an email with a DocuSign logo and a "Review document" button.
2. The message sometimes comes from a real account that was hacked, so it can look like it's from someone you know.
3. The button leads to a fake login page (Microsoft 365, Google, and so on).
4. You type your email and password, and the scammers collect them.
5. With your mailbox, they send the same trap to your contacts or try to redirect payments.

Signs to look for

• You aren't expecting any document from that person or company.
• The sender's address: the display name says "DocuSign", but the address comes from another domain or a free mailbox.
• A strange link: hover over it without clicking. If the address isn't DocuSign's, be suspicious.
• A vague subject: "Important document", "Contract", "Invoice", with no detail.
• Urgency: "sign before tonight", "the link expires".
• An attachment (PDF, HTML) that holds the link itself. A real request uses a link to the service, not a file you have to open.
• A request for your email password just to "view" the document.

A message can be copied very well. The safest habit is never to use the link in it.

What to do

1. Don't click and don't open the attachment.
2. If you know the sender, call them or write on another channel to ask whether they really sent it.
3. If you have a DocuSign account, sign in by typing the website address yourself: pending documents show there.
4. Report it: in the US at reportfraud.ftc.gov, in the UK by forwarding the email to report@phishing.gov.uk.

What if I already clicked or typed my password?

• Change your password right away, from a device you trust, then change it on any site where you reuse it.
• Turn on two-step verification.
• Look at the forwarding rules and sent messages in your mailbox, since scammers sometimes leave traces there.
• Warn your contacts that a suspicious message may have come from you.
• At work, tell your IT team immediately.
• If you lost money, report it to the police and keep the evidence.

To learn what to look for in any message, see how to spot a phishing email. The trick is close to CEO fraud: a message that seems routine but pushes you to act fast.

Check it with Fishi

Forward the suspicious email to check@fishi.email, ideally as an attachment so the technical details are kept. Fishi examines the sender, links, attachments and content, then replies with a clear verdict and what to do. It's free and needs no account. No tool is perfect: if in doubt, always ask the sender through another channel.