Fake DocuSign Email｜How to Check Before Opening a Document
A DocuSign email can look completely legitimate.
It may show a familiar company name, a professional document title, and a large Review Document button. But fake DocuSign emails are commonly used to send people to phishing pages or other malicious websites.
Docusign has warned about campaigns where fraudulent emails were spoofed to appear as if they came from docusign.net or docusign.com, even though they did not originate from Docusign’s legitimate systems. That means checking the visible sender name alone is not enough.
The safest rule is simple:
Before opening an unexpected document, check the sender, document context, and destination link—and verify the request separately when anything feels unusual.
1. Ask whether you were expecting the document
Start with the context.
Before clicking Review Document, ask:
- Was I expecting a contract, invoice, agreement, or form?
- Do I recognize the person or company sending it?
- Does the document title make sense?
- Was this document mentioned in a previous conversation?
An unexpected document is not automatically malicious, but it deserves more attention.
Be especially careful with vague subjects such as:
- Document Ready for Signature
- Confidential Agreement
- Updated Invoice
- Urgent Contract Review
- Action Required
Docusign recommends asking whether you expected the email and whether you recognize the sender before interacting with a document request.
2. Check the full sender information
Do not rely only on a display name such as Docusign, HR Department, or Accounts Payable.
Expand the sender details and look for:
- An unfamiliar sender
- A misspelled domain
- An unrelated company address
- A free email account that does not match the supposed sender
- A sender name and email address that do not match
However, there is one important limitation:
A familiar-looking Docusign domain is not absolute proof that the email is safe.
Docusign has specifically warned about spoofed emails designed to appear as though they came from legitimate Docusign domains.
So use the sender address as one check—not your only check.
3. Check the document context before opening it
A fake request often becomes suspicious when you look at the details.
For example:
You receive an “Employee Compensation Agreement” from a company you have never worked with.
Or:
You receive a “Final Invoice” even though you have no active purchase or contract.
The email design may look professional, but the business context does not make sense.
If the document supposedly came from a coworker, vendor, customer, bank, or HR department, verify the request through a communication channel you already trust.
A quick message such as:
“Did you just send me a DocuSign document called ‘Updated Agreement’?”
can resolve the situation without clicking anything.
4. Hover over the Review Document button
Before clicking, hover over the Review Document button or link.
Look at the actual destination.
Be cautious if the URL:
- Leads to an unrelated website
- Uses an unfamiliar domain
- Contains unusual spelling
- Redirects through a suspicious link-shortening service
- Opens a page that does not resemble your normal Docusign workflow
Docusign advises users to inspect links before clicking and notes that a link in a suspicious message that does not point to an official Docusign website may indicate a scam.
Do not assume the button is safe just because it says Review Document.
The button text and the actual destination can be completely different.
5. Open Docusign directly when possible
When you are unsure, avoid using the email link.
Instead:
- Open a new browser tab
- Go to Docusign through your normal trusted route
- Sign in to your account
- Check whether the expected document or agreement appears there
Docusign recommends accessing the service directly rather than clicking suspicious email links when verifying a questionable notification.
This is especially useful when the email claims that you have an urgent agreement waiting.
If you cannot confirm the request through your normal account or with the sender, stop before entering any information.
6. Be careful with fake sign-in pages
A phishing link may open a page that looks similar to:
- Microsoft 365
- Docusign
- Your company login portal
The goal may be to steal your email address and password rather than the document itself.
Before signing in, check:
- The full website address
- Whether the login request was expected
- Whether the page matches your normal sign-in process
- Whether you were redirected to an unrelated domain
Do not enter your work password simply because the page contains a familiar logo.
7. Watch for unusual downloads
An electronic signature request should not unexpectedly pressure you to download random software.
Stop if the document link suddenly asks you to download:
- An executable program
- A ZIP file
- A browser update
- An unknown security tool
- An unrelated document viewer
When the behavior does not match the document you expected, close the page and verify the request separately.
A 30-second DocuSign email checklist
Before opening an unexpected document, check:
Was I expecting this document?
Do I recognize the sender and the business context?
Does the full sender information make sense?
Where does the Review Document link actually go?
Can I verify the request directly through Docusign or with the sender?
Am I being asked for an unexpected password or download?
If something does not match, stop before continuing.
How to report a suspicious DocuSign email
Docusign provides a way to report questionable messages.
If you believe an email may be fraudulent, Docusign says you can forward the entire suspicious email as an attachment to:
Docusign also provides fraud-reporting resources and, in supported workflows, a Report Abuse feature.
For a work account, you should also report suspicious messages to your company’s IT or security team.
What if you already clicked the link?
If you opened the page but did not enter information or download anything, close the page and report the message.
If you entered a password on a suspicious website:
- Change the affected password through the real service
- Do not reuse the compromised password elsewhere
- Notify your IT or security team for a work account
- Review recent account activity
- Enable multifactor authentication where available
The faster you respond, the easier it may be to limit unauthorized access.
Final takeaway
A fake DocuSign email does not always contain obvious spelling mistakes or bad design.
Some phishing messages can closely imitate legitimate document notifications, and Docusign has warned that attackers may even spoof familiar-looking sender domains.
Before opening a document, check four things:
Were you expecting it? Who actually sent it? Where does the link go? Can you verify the request another way?
That short check is usually much easier than dealing with a stolen account after clicking the wrong document.
