Protect Yourself From This DocuSign Phishing Scheme

As its name implies, DocuSign makes signing documents easy. In an increasingly digital world, we are signing more and more official papers electronically, and services like DocuSign power that progress.

Of course, as DocuSign’s popularity skyrockets, so, too, does the risk for bad actors to use it against users. This isn’t a theoretical situation: DocuSign itself is warning users to be cautious and on the lookout for phishing schemes. Luckily, if you’re well acquainted with typical phishing schemes, you should have no problem spotting a DocuSign scam.

Like any other phishing scheme, a DocuSign phishing attack will have fake URLs, false sender addresses, and grammar and spelling mistakes. One quick tell is to hover your cursor over the DocuSign link. If it’s legit, it should read docusign.net. If not, you may see something like docs.google.com or feedproxy.google.com.

If the email address is coming from any other domain other than docusign.net, it’s almost certainly a scam. However, bad actors can “spoof” an email address in these messages, and send a fake email that shows up with a legitimate address. Because of that, it’s not a reliable metric to look for.

The email in question is likely riddled with issues to a discerning eye. If the message doesn’t address you by name, and instead goes with something like “Dear Receiver,” you should assume the worst. Also, look out for the length of the code these emails purport to offer. If it’s shorter than 32 characters, it’s probably fake.

But even following the above steps can get you in trouble: Bad actors are using free or stolen DocuSign accounts, uploading malicious files to them, then sharing that file to your account. It’ll come with a legitimate address and security code, making it look real. But once you sign in and bypass DocuSign’s security protocols, you’ll install the malicious file. If in doubt, always double-check with the “sender” via a trusted communication source to see if they really sent you something. If not, safely assume it’s a scam, and leave it alone.