DocuSign scams
Last updated September 19, 2026
The short answer
DocuSign scams come in two forms: fake emails imitating a signature request, and genuine DocuSign envelopes sent by fraudsters carrying a fraudulent invoice. The safe habit for both is the same — never click the button in the email; go to docusign.com and enter the security code instead.
DocuSign is the rare brand where the harder attack uses the real product. Anyone can open an account and send a legitimate envelope, so the email passes every authentication check, arrives from a real DocuSign domain, and carries a genuine signing link — while the document inside is an invoice for services never rendered, or a form designed to collect banking details. The counterfeit version is simpler and older, and both are defeated by the same habit.
How DocuSign scams work
- 1
Counterfeit signature requests
An email imitating DocuSign says a document is waiting. The button leads to a fake Microsoft or Google login, harvesting credentials rather than showing any document.
- 2
Real envelopes, fraudulent contents
A fraudster opens a DocuSign account and sends a genuine envelope containing a fake invoice, often with a phone number to call about the charge. The email is authentic, which is why it lands in the inbox rather than the spam folder.
- 3
Business email compromise
In a compromised business account, a fraudulent envelope is sent to real contacts requesting a signature on changed payment instructions — the highest-value version of this.
- 4
Fake attachments
Some versions attach an HTML or PDF file that opens a local credential-capture page, bypassing link scanners entirely.
Warning signs
- You were not expecting a document from that sender
- The signing link asks you to log into email rather than showing a document
- The document is an invoice with a phone number to dispute it
- The sender name is a company you know but the email address is not theirs
- The email has an attachment instead of a DocuSign link
- The document requests bank details or changed payment instructions
- Language is urgent — an account closing, a contract lapsing
Examples
The $312 invoice in a real envelope
A genuine DocuSign envelope arrives with an invoice for antivirus renewal and a number to call to cancel. The email passes every check because it really is from DocuSign. The number leads to a tech-support scam that requests remote access to "process the refund".
Changed wire instructions
A compromised supplier account sends a DocuSign envelope to a customer with updated banking details for an existing invoice. The envelope is real, the supplier relationship is real, and the account number is the fraudster's. $84,000 is paid to it.
What to do
- Never click the button. Go to docusign.com, choose to access documents with a security code, and enter the code from the email.
- Verify unexpected documents with the sender on a number you already had.
- Treat any change of payment instructions as fraud until confirmed by voice on a known number.
- Never call a phone number printed inside a document you did not expect.
- Report abuse to DocuSign — they close fraudulent sender accounts.
Report it to DocuSign
Forward suspicious envelopes to verify@docusign.com. DocuSign closes accounts used to send fraudulent documents.
Getting your money back
If a payment went to changed instructions, call your bank immediately and file at ic3.gov — the FBI Recovery Asset Team has recalled a substantial share of business email compromise wires reported within roughly 72 hours, and the speed of the report is the deciding factor. If credentials were entered, change that password everywhere it was reused, revoke active sessions, and check mailbox rules, since attackers commonly add a forwarding or auto-delete rule to hide their follow-up. Forward the envelope to verify@docusign.com so the sending account is closed.
Frequently asked questions
How do I check a DocuSign request safely?
Every genuine DocuSign email contains a security code. Go to docusign.com yourself, choose the option to access documents with a code, and enter it. This works for real documents and fails for fakes, without you ever clicking a link in the email.
The email really came from DocuSign. Doesn't that mean it is safe?
No. Anyone can open a DocuSign account and send a genuine envelope, so the email can be entirely authentic while the document inside is fraudulent. Authentication tells you the envelope is real; it tells you nothing about the contents or the sender's intent.
Why do fake invoices include a phone number?
Because the phone call is the actual scam. The invoice exists to make you dial, and the person answering runs a refund or tech-support script that ends in remote access or a payment. Never call a number printed inside an unexpected document.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about DocuSign, these are the guides worth reading next.