Docusign email scams, fake Docusign emails, and phishing attempts are on the rise. Attackers use the platform’s credibility to trick users into handing over personal data, login credentials, or even money.
Why scammers impersonate Docusign
- Massive user base: DocuSign serves over 1 billion users and 1.6 million businesses, including 95% of the Fortune 500.
- Real accounts abused: Attackers often create actual DocuSign accounts and use official templates to send fake invoices from brands like PayPal or Norton.
- Legit-looking domains: Many phishing emails come from the legitimate @docusign.net domain and easily bypass spam filters.
Identify a fake Docusign email
Look out for these signs:
- Link preview: Hover over any link — real ones will start with docusign.net or docusign.com. Suspicious or shortened URLs are a red flag.
- Sender address: Genuine emails come from @docusign.net. Anything else (like Gmail or random domains) is likely fake.
- No attachments: DocuSign doesn’t send .zip, .exe, or .docx files in the first email.
- QR codes: Be careful with QR codes — scammers sometimes use them to hide phishing links.
- Urgency, threats, typos: Messages that push you to act fast, contain spelling errors, or feel aggressive are likely phishing attempts.
Protect your business and team
Create a simple checklist for your employees:
- Were you expecting this email?
- Is the domain legitimate?
- Are there attachments or QR codes?
- Does the message pressure you to act quickly?
- Are there spelling or formatting issues?
Also, invest in:
- Mail filtering and URL scanning tools.
- QR code protection and endpoint security.
- Two-factor authentication and password managers.
- Phishing simulations to train staff.
- A clear incident response policy.
If you’ve been targeted
- Do not open the suspicious message.
- Forward it as an attachment to spam@docusign.com.
- Delete it from your inbox and trash.
If you interacted with it:
- Change your password immediately.
- Inform your IT/security team.
- Monitor for unusual activity.
If money was transferred, contact your bank or payment provider immediately. If sensitive data was shared, inform all affected parties and implement additional access controls.
Create Digital Signature
Tap in area to upload your document
Drop your file or click to upload your document.
