Report to Docusign

• Emails spoofed to look like they came from docusign.net or docusign.com
• Fake invoices and billing envelopes sent through a forwarding service
• QR codes in envelopes leading to fake login pages
• Signature requests you were not expecting

1. 1

   Forward it as an attachment to verify@docusign.com

   Docusign analyses it and replies to say whether the content is legitimate or suspicious, along with what to do next. That is worth using before you click anything.

2. 2

   Check the sender domain

   A genuine envelope comes from an official Docusign domain such as @docusign.net. Spoofed mail is made to look like it did but does not originate there.

3. 3

   Use the security code instead of the link

   A real Docusign email carries a unique security code. Go to the official Docusign site and use the code to open the document, rather than clicking the link in the email.

4. 4

   Do not scan the QR code

   Docusign has flagged scam emails containing a malicious QR code that leads to a fake login page. The envelope itself may carry a second one.

• The email, forwarded as an attachment
• The sending address
• The envelope or security code, if there is one

You get a verdict back, which is rare and makes this worth doing first. If you already signed in on a fake page, change that password immediately and treat the account as compromised.