Tools to Protect Your Data From Phishing

It’s becoming increasingly difficult to tell facts from phishes. And as bad actors become more savvy, it’s important for professionals to equip themselves with the right tools to safeguard their most sensitive data.

Phishing is a technique used by attackers to trick individuals into divulging personal information—like login credentials—or launching malware to steal broader sets of data stored on their computers or connected networks. A phish typically looks like a valid email from a trusted source, duping recipients into opening the email and clicking on enclosed attachments or links.

It is an old tactic that’s only growing in popularity. The Anti-Phishing Working Group during the first months of 2022 observed the worst quarter on record, with more than one million phishing attacks recorded. In this post, we highlight key tips to protect your organization from phishing attacks.

Train people to identify phishing risks

According to the 2022 Verizon Data Breach Investigation Report, 82 percent of data breaches were caused by human mistakes. The 2022 Tessian report on human error shared that nearly half of surveyed employees said they were at least fairly certain they’ve made a mistake that led to security repercussions. These figures highlight the importance of ensuring employees are properly trained to identify, flag and report suspicious emails.

Companies can help their employees avoid making mistakes through training and awareness activities. One way to do so is with phishing simulations to teach employees how to recognize and report malicious content. These simulated threats help people identify questionable emails and get into the habit of reporting them for investigation.

Learn how to stop and recognize phishing

One of our top priorities is to make your DocuSign experience as safe and secure as possible — trust is in our DNA and ingrained in our people, processes, and technologies. In addition to delivering a secure experience, we can also provide tips to protect your data from phishing.

We are committed to employing the latest technology and industry knowledge to keep our customers safe from attackers—but it takes awareness and commitment from everyone involved to achieve the highest level of security. Learning how to recognize suspicious emails is the best way to protect yourself and your data.

Ask yourself the right questions

Generally, it’s best to be skeptical about strange emails. Here’s a quick checklist of questions you can run through to ensure an email is legitimate: 

  • Are you expecting the email?
  • Do you recognize the sender?
  • Do the email signature and the sender name/email address match?
  • If it's a DocuSign email, does it have the new and correct logo and branding?
  • Is the look or tone off from the norm?
  • Are there spelling or grammar errors throughout?
  • Is it more generic than it should be?
  • Is it asking for you to provide your personal or login information?
  • Are the links taking you to a valid and expected place (hover over them without clicking on your computer or long tapping on your mobile device to see the link)?
  • Are there strong emotions or an urgency communicated? 
  • Do you feel like it’s just weird?

To protect your accounts, enable multi-factor authentication when possible, use strong and unique passphrases and ensure your antivirus software is up to date.

How to detect DocuSign-themed phishing attempts

A few simple techniques can help you spot the difference between a spoofed DocuSign email and the real thing:

  • Don’t open unknown or suspicious attachments or click links—DocuSign will never ask you to open an office document or zip file in an email. Note: in the final email you receive that states the envelope is complete, you may receive a completed PDF signed document as an attachment
  • Hover over all embedded links—URLs to view or sign DocuSign documents contain “docusign.net/” and always start with https
  • Access your documents directly from www.docusign.com by entering the unique security code, which is included at the bottom of every DocuSign email
  • Report suspicious DocuSign-themed emails to your internal IT/security team and to spam@docusign.com
Screenshots of fake Docusign emails and login pages

DocuSign proactively detects and deters phishing attempts by tapping into the deep expertise and experience of the DocuSign security team in combination with sophisticated automated techniques, including:

  • Leveraging custom automation tooling (developed in conjunction with the DocuSign cybersecurity team) to process potentially fraudulent URLs submitted to spam@docusign.com by customers or reported in threat intelligence feeds
  • Utilizing machine learning algorithms to improve accuracy and reduce false positives when identifying phishing attempts
  • Using performance dashboards and visualizations to track phishing trends over time and analyze phishing pages in real time
  • Enforcing a DMARC (Domain-based Message Authentication, Reporting and Conformance) reject policy on DocuSign.net, so any spoof email purportedly sent from docusign.net is rejected by all email providers supporting DMARC, after which the email content is sent to DocuSign for analysis
  • Partnering with leading security vendors and law enforcement organizations to share, take down and add to deny lists any malicious websites and prevent further phishing attacks

For DocuSign security and system performance information, visit the DocuSign Trust Center.

Published