Fake DocuSign Email? How to Spot It and What to Do If You Signed In

What should I do right now if I clicked a fake DocuSign email?

Stop, and don’t type anything else into the page. If you only clicked and closed it, report it and you’re probably fine. If you entered a password, treat the account as taken. Change it from a different device, call IT, and warn anyone you’re mid-transaction with. Here’s the order:

1. Close the tab. Don’t download or “unblur” anything it offers.
2. Don’t delete the email. IT needs it to see who else got it. Forward it as an attachment to IT, and to verify@docusign.com, the address DocuSign gives for reporting.
3. If you typed a password, change it from a different device, like your phone or a coworker’s PC. Use a new password you haven’t used anywhere.
4. Call IT, don’t email them. If the attacker is in your mailbox, they can read your email to IT too.
5. If a wire is pending, phone the other side at a number you already had on file. Tell them not to trust any emailed instruction change until you call back.
6. If money already moved, call your bank first. The FBI says to ask your bank to recall the funds and file at ic3.gov “as soon as possible,” whatever the amount.

That last step is about the real danger. The fake envelope isn’t the attack. Your inbox is what they’re after.

How do I tell a real DocuSign email from a fake one?

A real envelope notification comes from the @docusign.net domain and has a 32-character security code at the bottom, under “Alternate Signing Method.” DocuSign’s fraud resources page says both of those things. The safest test is to skip the email. Go to docusign.com, use Access Documents, and paste the code.

If the envelope opens there, it’s real. If the code doesn’t work, or there’s no code at all, treat it as fake.

Some other tells, all from DocuSign’s own guidance:

• Links that don’t go to DocuSign. DocuSign’s phishing guide says a real signing link begins with https://www.docusign.net, sometimes with a server prefix like na2 or eu. Hover before you click. A link to a random domain, a file-sharing site, or a “secure viewer” is wrong.
• Attachments. DocuSign says it “will never ask you to open an office document or zip file in an email.”
• A login wall. DocuSign’s safety alerts say: “Do not enter your username or password on a page you reached from an email or QR code.” A “sign in to view the document” page asking for your Microsoft 365 or Google password is the phish.
• Off branding. A June 2025 DocuSign alert warns that fakes “may use color schemes or branding that do not match Docusign’s official look and feel.”

Can a fake DocuSign email come from a real DocuSign address?

Yes. DocuSign’s own safety alerts page says “attackers use registered Docusign accounts to send envelopes” with legitimate-looking documents. In that August 20, 2026 alert, the envelope showed a blurred document with a prompt to unblur it. Clicking it led to a malicious site that wanted the person to download a file, and that download gave the attacker access to the device.

So the sender domain checks out and the email passes your filters, and it’s still an attack. That’s why “it came from docusign.net” doesn’t settle it. Ask two things instead. Were you expecting this document from this sender? Does the page it opens want anything besides a signature? If the answer to the first is no, call the sender at a number you already have. The same alerts page lists other fakes too, including QuickBooks impersonation and fake invoices.

Why do title companies and law firms keep getting these?

They work in DocuSign every day, so one more “Please review and sign” email looks normal. A title company might get dozens of envelopes a week from lenders, agents, and buyers. A law firm sends engagement letters and settlement papers the same way. Nobody stops to wonder about one more.

The other reason is money. Those same inboxes coordinate large wires on a schedule everyone can guess. Take over a closer’s mailbox and you can see which deals fund this week and who’s on the other side.

What happens after someone enters their password?

The attacker logs in to your mailbox and gets ready to redirect a payment. Microsoft documented this in a 2022 campaign against more than 10,000 organizations. The fake page stole the session after MFA, and in one case payment fraud started within 5 min of the theft. The attackers made inbox rules that sent replies from their targets to Archive and marked them read, so the real user never saw them.

That’s business email compromise. We’ve seen the inbox half of it firsthand. In our BEC case at a title company, the attacker sent fake wire instructions on a real closing from the closer’s own account, then built filters to hide the thread from coworkers. A phone call to the other side stopped the wire.

Microsoft’s guide to a compromised mailbox lists what IT should do. Have IT do this part:

• Disable the account or reset the password, and don’t send the new password by email.
• Revoke every active session so a stolen cookie stops working.
• Remove MFA methods and devices the user doesn’t recognize.
• Review apps the user consented to.
• Check for mailbox forwarding and inbox rules, including hidden ones.
• Read the sign-in logs and Sent Items from the start of the incident.

A password reset alone is not enough. Without revoking sessions and pulling the rules, the attacker can stay in.

How do we stop fake DocuSign emails from working next time?

You won’t stop every one from landing. The point is to make the click cheap. These controls do that, roughly in order of value:

• Enforce MFA on every mailbox. Enrolled isn’t enforced. That gap is how our BEC case got in.
• Use phishing-resistant MFA for anyone who touches wires. Phishing-resistant MFA won’t sign in to a fake page, so a stolen password plus a fake login page gets the attacker nothing.
• Alert on new inbox rules, forwarding, and odd sign-ins. That’s where a takeover shows up first.
• Run endpoint detection on every PC, for the variants that push a download instead of a login page.
• Have a callback rule for wire instructions. Our wire verification procedure lays out the call, and it works even when everything else fails.
• Teach one habit: open envelopes through Access Documents, never from the link.
• Write down who does what in an incident response plan, so step 4 above isn’t figured out live.

Key takeaways

What this looks like when we do it

On our managed IT and security baseline, MFA is enforced across the whole tenant, not left up to each user. We monitor for the new inbox rules, forwarding, and sign-ins that come after a phish. Every machine gets endpoint detection and response. Critical issues get a response in under 15 minutes, so “I think I typed my password into something” turns into revoked sessions and a clean mailbox fast.

For title companies, we start with the wire. The people who send and confirm wires get MFA that a fake page can’t capture, and the callback procedure gets written down and tested. The same managed security baseline covers law firms and the other regulated offices we support. Your staff will still see fake DocuSign emails. We want the click to cost you a password reset and nothing more.

Got a “please review and sign” email you’re not sure about, or one someone already clicked? Book a call below and we’ll go through it.