A DocuSign scam email uses a signing request to steal information or money. If the request is unexpected, first call the supposed sender on a number you already trust. A genuine DocuSign notification can still carry a fraudulent request.
While you check the message:
- Leave its links and attachments unopened.
- Check whether you are expecting a document from that organisation.
- Use an existing contact number to confirm the document’s name and purpose.
- If you already entered a password or downloaded software, start the response steps below immediately.
How DocuSign Scam Emails Work
DocuSign scam emails either impersonate the signing service or misuse real DocuSign accounts to deliver fraudulent documents. The logo and a familiar sender name cannot establish who authorised the request.
A credential phishing message sends you to a fake sign-in page. It might claim that a loan document is ready, then ask for your email password to view it. The attacker uses the password to access your mailbox or other accounts where you reused it.
An invoice or payment lure asks you to approve a purchase, pay an unexpected bill or call a supposed billing team. Calling a number inside the document can put you directly in contact with the scammer.
DocuSign’s fraud alerts describe both fraudulent payment requests and phishing delivered through registered accounts. Some documents contain external links, QR codes or a blurred preview that asks you to download software.
For a broker, an unexpected settlement document deserves the same independent check as an unexpected invoice. A familiar lender name and urgent wording do not confirm that the lender sent it.
Check Whether a DocuSign Email is Real
Check the sender and the envelope separately, then confirm that the document matches the transaction you expect. An envelope is the document package sent through DocuSign.
- Confirm the request with the supposed sender using a saved phone number or established client portal. Ask which document they sent and who must sign it. If they deny sending it, stop and report the message.
- Expand the sender details. Compare the actual address with the display name and inspect the reply address. DocuSign says envelope notifications come from its docusign.net domain. A matching domain alone cannot prove that the customer’s request is legitimate.
- Open DocuSign’s official website independently. Select Access Documents and enter the security code from the email’s Alternate Signing Method section. This avoids using the email’s signing button.
- Check the document reached through that route. Compare its sender, client details and requested action with what your known contact confirmed. Stop if it asks you to visit another site, install a viewer or authorise an unexplained payment.
- If the code is missing or fails, ask the known sender to confirm or resend the request. Do not switch back to the suspicious link as a workaround.
DocuSign’s fraud resources explain the security-code method. Reaching an envelope on the official service establishes where it is hosted. You still need to establish who sent it and whether you should act on it.
A hypothetical example shows the distinction. Your lender contact confirms sending a loan agreement, and the independently opened envelope contains that agreement for the correct borrower. You can continue the normal signing checks. If the same envelope instead contains an unrelated software invoice, leave it unsigned and contact the sender again.
Is DocuSign Itself Safe?
Yes, DocuSign has security controls for electronic signing, but those controls cannot make every customer’s request trustworthy. Scammers can use genuine accounts as well as imitation websites.
DocuSign’s eSignature security documentation describes encrypted documents, protected data transfers and a Certificate of Completion for signed documents. Its account guidance also recommends a unique password and multi-factor authentication, which adds another sign-in check.
These controls protect the service and its records. A real sender can still upload a fraudulent invoice or place a malicious external link inside a document. Decide whether to sign from the confirmed business purpose and the document’s contents.
Protect Clients From Fake Signing Requests
Tell clients what signing request to expect before sending it. Include the sending organisation, the document’s purpose and the name of the person they can contact.
Give the client a known brokerage phone number through your usual communication channel. Ask them to call that number if the request differs from what you described. A reply to a suspicious message can reach the attacker.
For example, tell a client that the lender will send their loan agreement through DocuSign after approval. Explain how the client can confirm it with your brokerage before opening it. Avoid asking clients to trust every message carrying the lender’s logo.
Keep payment verification separate from document signing. If a document introduces new bank details or an unexpected payment, confirm those instructions through a trusted contact before anyone transfers money.
If You Clicked the Link
Respond according to what happened after the click. Tell your brokerage’s IT provider or security contact promptly and preserve the original message for investigation.
If you opened the page
Close the page and stop interacting with it. Record what you opened and whether the browser downloaded anything or asked for account access. Give that information to IT so it can assess the device and account activity.
If you entered a password or approved access
From a trusted device, open the affected service directly and change its password. Change any other account that uses the same password. Ask IT to revoke active sessions and review recovery details and connected applications.
Check mailbox forwarding and inbox rules for changes you did not make. Review sent and deleted messages for fraudulent correspondence. Enable multi-factor authentication and investigate unexpected approval prompts.
The Australian cyber security mailbox recovery guidance covers these checks. Confirm recovery with IT by checking that unauthorised sessions and forwarding rules are gone and account activity has been reviewed.
If you downloaded software or sent money
If you ran a suspicious download, disconnect the affected device from the network and contact IT. Use a different trusted device for account recovery. Preserve the file details and let IT decide how to inspect and restore the device.
If money moved or banking details were exposed, contact the financial institution immediately through its official channel. Ask it to stop or recall the payment. Preserve transaction references and notify affected clients through a trusted channel.
Report the message and assess client exposure
Follow DocuSign’s reporting instructions. For an impersonation email, or when you are unsure of its origin, forward the entire email as an attachment to verify@docusign.com. Preserve your investigation copy before deleting the inbox message. For abuse within a genuine envelope, use the official Report Abuse feature.
Report suspicious contact to Scamwatch. Use ReportCyber to report cybercrime, including stolen information or money. A report does not replace urgent contact with your bank or IT provider.
If client information was exposed, involve your privacy contact and licensee in the assessment. The Office of the Australian Information Commissioner (OAIC) explains the Notifiable Data Breaches scheme.
For an entity covered by the scheme, notification generally applies when unauthorised access, disclosure or loss is likely to cause serious harm that remedial action cannot prevent. Take all reasonable steps to complete a suspected-breach assessment within 30 days. Notify the OAIC and affected individuals as soon as practicable once an eligible breach is established.
Record which client files were accessible and what the attacker did. Keep the containment actions and notification decision with that incident record before returning to the affected signing workflow.
