Document lures guide
How to check a DocuSign phishing email
Document-signing lures borrow familiar branding and an expected business action. Confirm the envelope and sender through an independent route before opening it.
Decide whether an envelope is expected
A real document normally connects to a transaction, person or workflow you recognize. Ask the supposed sender through an existing phone number or conversation. Replying to the suspicious message only proves that the sender controls its own reply address.
Open the service independently
Use the official app, a saved bookmark or an address you type yourself. Check pending envelopes after signing in. A request that exists only behind the email button deserves more scrutiny.
Compare the visible sender with the technical sender
The display name may say DocuSign, a lawyer or a customer. The original source shows the actual From domain, Reply-To, envelope sender and authentication domains. A mismatch can be legitimate when an authorized platform sends for a customer, but the domains and expected workflow should agree.
Watch the second page
Some lures first show a harmless document preview and then request Microsoft, Google or webmail credentials. A signing flow should not unexpectedly ask for a different account's password. Close the page and reach the service independently if the login context changes.
Respond after a mistake
Change any entered password from a trusted device, revoke unfamiliar sessions and review multi-factor settings. If a downloaded file was opened, disconnect the device from sensitive work until it can be examined. Preserve the original message and the page address for the incident record.
Action checklist
- Confirm the envelope with the sender through an existing conversation.
- Look for the document inside the official signing account.
- Stop if the page unexpectedly asks for a different account password.
Questions people ask
Can a legitimate DocuSign notice come from a platform domain?
Yes. Confirm the envelope in the official service and verify the business context independently.
Should I forward the email to inspect it?
Forwarding can rewrite headers. Save or provide the original .eml when possible.