Scam library · Email & phishing · Small business
DocuSign phishing email: 'please review and sign'
'You have received a document to review and sign: Q4 Bonus Payment' or 'Completed: Invoice 4471'. A yellow 'Review Document' button sits in the middle of a clean, familiar DocuSign design.
Fake e-signature emails are among the most common phishing lures at work. The button leads to a login page that asks for your Microsoft 365 or Google password.
What the message looks like
From: DocuSign via Ann Lee <dse@docusign-review[.]net>
Subject: Please DocuSign: 2026 Compensation Adjustment.pdf
Human Resources sent you a document to review and sign.
[ REVIEW DOCUMENT ]
Please complete by end of day. Do not share this email.
How this scam works
Scammers now also send real DocuSign envelopes from free accounts, so the email technically comes from DocuSign. Inside, the document contains a link or a phone number, or asks for payment to a new account. That's why checking the sender of the envelope matters more than the logo.
Once scammers have your work email password, they read your inbox, find real invoices and customers, and send convincing payment change requests. That's how many business email compromise attacks start.
The FBI counted $3.05 billion in business email compromise losses in its 2025 Internet Crime Report.
Red flags
- A sender domain that isn't docusign.net or docusign.com.
- A document you weren't expecting, especially about pay, bonuses, HR or overdue invoices.
- The button takes you to a page asking for your email password.
- 'Do not share this email' or end-of-day pressure.
- Inside a real envelope: a phone number, a link elsewhere, or new bank details.
How to tell it’s fake
- Copy the security code at the bottom of a real DocuSign email and use 'Access Documents' at docusign.com instead of clicking the button.
- Ask the sender, by phone or a separate message, whether they sent it.
- Your DocuSign envelopes never require your email password to open.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you clicked but didn't sign in, close the page and report the email to your IT team or forward it to spam@docusign.com.
If you paid
- If an envelope asked you to pay, call the requester using a known number before sending anything.
If you shared personal info, a password or a code
- If you entered your password, change it now, sign out of all sessions, and tell IT. Check your mailbox for new forwarding rules.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard runs in Chrome and Edge on your computer. It checks e-signature emails you have open in Gmail or Outlook on the web and the pages they lead to. If a 'DocuSign' page lives on a lookalike domain or asks for your email password, it warns before you type. If a document request seems legit but unexpected, check with a scam expert or the sender first.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- How do I know if a DocuSign email is real?
- Check the sender domain and use the security code at docusign.com rather than clicking. Ask the sender through another channel if you weren't expecting it.
- Do I need to log in to view a DocuSign document?
- Not with your email password. Real envelopes open without asking for it.
- I typed my Microsoft 365 password. What now?
- Change it right away, turn on multi-factor authentication, and tell your IT team.