That DocuSign Email Might Not Be From DocuSign

The Email Everyone Opens

If you run a business in Palm Beach County, you sign things all the time. Leases, vendor agreements, insurance renewals, closing docs, and that HOA form nobody reads. So when an email shows up saying “Please review and sign: Agreement_Final_v2.pdf,” you don’t think twice. You click.

Scammers know that. Fake e-signature emails are one of the most reliable ways they steal Microsoft 365 and Google logins right now. They work because they look exactly like the real ones. Same yellow button, same logo, and sometimes even the same sending service.

How the Scam Works

The basic version is simple. You get an email that looks like it’s from DocuSign, Adobe Sign or Dropbox Sign. You click “Review Document.” Instead of a contract, you land on a login page that wants your Microsoft or Google password “to verify your identity.” You type it in, the page spins, maybe it shows a blank PDF, and you get on with your day.

Meanwhile someone just got into your email.

From there it gets ugly fast. They read your inbox to see who pays you and who you pay. They set up forwarding rules. Then they send the same fake DocuSign to everyone in your contacts, and this time it comes from you, a real person those contacts trust. That’s how one click at a title company in Boca turns into twenty clicks across every lender and realtor they work with.

The nastier version

Some attackers don’t bother faking DocuSign. They sign up for a real account and send real envelopes. The email actually comes from DocuSign’s servers, so it passes every spam check your email provider runs. The document inside might be a fake invoice with “updated” bank details, or it might have a link to a phishing page tucked inside the PDF.

So “it came from docusign.net” doesn’t prove anything. The question isn’t whether DocuSign sent it. The question is whether someone you actually do business with sent it.

Red Flags Worth Two Seconds of Your Time

You weren’t expecting anything. Real contracts usually follow a phone call or an email thread. A random “Final Agreement” out of nowhere should make you suspicious.
The sender doesn’t match anyone you know. Look at who is asking for the signature, not the service delivering it.
It wants you to log in to view it. Real DocuSign doesn’t need your Microsoft password to show you a document. If a signature page asks for your email password, close it.
Vague file names. “Payment_Remittance.pdf,” “Q4_Bonus_Structure,” “HR Policy Update.” They’re built to make you curious, not to describe anything real.
Urgency. “Expires in 24 hours.” Contracts rarely self-destruct.
The link goes somewhere weird. Hover over the button on a computer, or long-press it on a phone, and check where it really points.

The Safe Way to Open Any Signature Request

This is the habit I want every office to build. Don’t click the button in the email. Instead:

Real DocuSign emails include a security code near the bottom, usually under something like “Alternate Signing Method.” Go to docusign.com yourself, pick the option to access documents, and paste the code in. If there’s no code, or the code doesn’t work, that tells you something.
For other services, log in to your account by typing the address yourself or using a bookmark. If the document is real, it’ll be waiting there.
Still not sure? Call the sender. Use a phone number you already have, not one from the email.

That last step sounds old school, but it stops almost every version of this scam cold, including the one that uses a real DocuSign account.

What to Set Up So One Click Doesn’t Sink You

Sooner or later, somebody will click. Everybody does. Your setup should make that mistake survivable.

Turn on MFA, and pick the good kind

Multi-factor authentication means a stolen password isn’t enough on its own. The catch is that the fancier phishing kits now grab your MFA code in real time as you type it. Phishing-resistant options like passkeys or security keys don’t have that problem, because they won’t work on a fake site at all. If you’re shopping for an upgrade, start there.

Watch for new inbox rules

One of the first things an attacker does is create a rule that hides replies or forwards mail out. Microsoft 365 can alert admins when that happens. Turn that alert on, and make sure it goes to someone who actually reads it.

Lock down who can approve apps

Some versions of this attack skip the password and ask you to “allow” a fake app into your account. Microsoft 365 and Google Workspace both let you require admin approval before a third-party app gets access. Do it.

Make a money rule

If a signed document changes where money goes, a phone call confirms it. No exceptions, and no “but they said it was urgent.”

If Someone Already Clicked

Don’t panic and don’t hide it. The faster you move, the less damage there is.

Change that account’s password from a different, clean device.
Sign the account out of every session. Microsoft 365 and Google both have a button for this.
Check inbox rules and forwarding settings for anything you didn’t create.
Give your contacts a heads-up so they don’t open anything “from you” for a while.
If a payment went out, call your bank right now. Hours matter.

Then thank the person who spoke up. If people get yelled at for reporting a click, the next person keeps quiet, and that’s how a bad afternoon becomes a bad month.

Before You Sign Anything Else

E-signatures saved us all a lot of printing and driving. They also handed scammers a perfect costume. Treat every surprise signature request the way you’d treat a stranger handing you a pen in a parking lot. Be polite and curious, and don’t sign until you know who they are.

Want your team to spot these before they click? That’s the kind of hands-on training we do at YourTech. Reach out through yourtech.solutions and let’s get your people ready.