Recognizing and reporting suspicious activities

You’re the first and best layer of defense in combating online threats, vulnerabilities, and associated risks that may result in cybercrime. Learning to properly detect and report these activities is the ultimate protection against cybercrime, including fraud.

If you think that you’ve received a fraudulent email pretending to come from DocuSign, send the email as an attachment to [email protected] and immediately delete it.

Fraudulent emails and websites

First and foremost, if you don’t recognize the sender of a DocuSign envelope and you’re uncertain of the authenticity of an email, look for the unique security code included in all DocuSign envelopes and found at the bottom of the notification email. If you don’t see this code, DO NOT click on any links or open any attachments within the email. Instead, go to, and simply enter the unique security code provided. For more information, please review our Combating Phishing White Paper.

Signs of fraudulent emails and websites

  1. Fake links

    Avoid fake links by accessing your documents directly from using the unique security code found at the bottom of the DocuSign notification email.

    Always check where a link goes before you click on it by hovering your mouse over the link to look at the URL in your browser or email status bar (they should be hosted on or A fraudulent link is dangerous and can:

    • Direct you to a fake website that tries to collect your personal data
    • Install spyware on your system (spyware is an application that can enable a hacker to monitor your actions and steal any login IDs, passwords, or credit card numbers you type online)
    • Cause you to download a virus that could disable your computer
  2. Fake sender email address

    Fake emails may include a forged email address in the "From" field. This field is easily altered. If you don’t recognize the sender of a DocuSign envelope, contact the sender to verify the authenticity of the email.

  3. Attachments

    DocuSign email requests to sign a document never contain attachments of any kind. DO NOT open or click on attachments within an email requesting your signature. DocuSign emails only contain PDF attachments of completed documents after all parties have signed the document. Even then, pay close attention to the attachment to ensure it is a valid PDF file. DocuSign NEVER attaches zip files or executables.

  4. Generic greetings

    Many fake emails begin with a generic greeting like “Dear DocuSign Customer.” If you don’t see your name in the salutation, be suspicious and don’t click on any links or attachments.

  5. False sense of urgency

    Many fake emails try to deceive you with the threat that your account is in jeopardy if you don’t provide immediate updates. They may also state that unauthorized transactions have occurred on your account or that DocuSign needs to update your account information immediately.

  6. Emails that appear to be websites

    Some fake emails are made to look like a website to get you to enter personal information. DocuSign never asks you for personal information, including login, ID, or password, via an email.

  7. Deceptive URLs

    Check the Web address. Just because the address looks OK, don't assume you're on a legitimate site. Look in your browser's URL bar for these signs that you may be on a phishing site:

    • Often the Web address of a phishing site looks correct but actually contains a common misspelling of the company name or a character or symbol before or after the company name, such as instead of
    • Look for tricks like substituting the number "1" for the letter "l" in a Web address or transposing consecutive letters of the brand, such as instead of
    • Your browser has ways of detecting certain types of malicious sites. Always heed these browser warnings, especially when they notify you that the site or certificate can’t be trusted.
  8. Misspellings and bad grammar

    While no one is perfect, fake emails often contain misspellings, incorrect grammar, missing words, and gaps in logic. Mistakes like this help fraudsters avoid spam filters.

  9. Unsafe sites

    The term "https" should always precede any website address where you enter personal information. The "s" stands for secure. If you don't see "https," you're not in a secure Web session, and you shouldn’t enter any personal data. A legitimate DocuSign sign-in page address always starts with “https://” not “http://.”

  10. Pop-up boxes

    DocuSign never uses a pop-up box in an email, because pop-ups aren’t secure.


If you think that you’ve received a fraudulent email, send the email as an attachment to [email protected] and immediately delete it.