DocuSign Scam: What is it and what should you do?

A fresh look at the DocuSign phishing scam

Phishing Lures: The Scammer’s Methods.

At first glance, everything about this email seems normal. For someone unthinkingly handling DocuSign documents on a daily basis, or someone waiting for a document, it would be all too easy to click.

1. Direct inbox delivery: These scammers know what they're doing. Thanks to their understanding of spam filters, scammers are able to slide this type of message past email filters, dodge the spam box, and land it right next to the email from Brenda from HR. Behind the scenes, the plain text version of the email confounds security software, and the result is prime placement of tempting clickbait.
2. Name and logo of a trusted company: The DocuSign name is synonymous with security and reliability. The cybercriminal's use of its name and logo plays directly to the potential victim’s inherent trust in these companies.
3. Passive CTA: Your radar should go off if you see a high pressure call to action (act now or we'll permanently delete your account). But this insidious email does not directly ask the victim for anything suspicious, avoiding the internal alarms that go off when someone receives a pushy email asking for payment.
4. Generic sender names and subject lines: Nothing to see here— and they're using that to their advantage. On the surface, everything about this email’s details seem like standard corporate communication.
5. Use of the ® (Registered Trademark) symbol: Although the detail might seem insignificant, when combined with professional logos, layout, and colors, the air of legitimacy around this email begins to build.
6. Incomplete message: Although this could simply be an error on the part of the scammer, or a tactic designed to avoid security measures (like we will see below), it could also be a genius move. The entire email is actually a clickable image that links the victim to the scammer’s landing page. Any attempts to click on the page to see the complete image could actually put the victim’s cybersecurity in real danger.

Red Flags: How to recognize a fake DocuSign email

Although this scammer has put some real effort into getting this message through to a target’s inbox, trained observers will quickly recognize several indications that the email is a fraud.

• Sender’s email address: Though many scammers conceal their identity by spoofing their sender name, a quick peek at the actual email address should reveal whether or not an email is legitimate. Communications from DocuSign should always end in @docusign.com or @docusign.net (or a regional equivalent). Any iCloud, Gmail, Yahoo, or other type of personal account indicates fraud. However beware spoofed email addresses. While dse_na4@docusign.net does end in the proper domain, make sure it is the actual sending address. (In Gmail, you can do this by clicking the little arrow next to the address for full information.)
• Information via image file. The entire body of this email is a PNG file. Though they may insert JPG or PNG files for visual flair, respectable organizations are not likely to send important information in an image file.
• No personally identifying information: Everything about this email is generic, since it is likely bcc’d to an anonymous list of potential victims. The scammer did not include any specific information in the email—such as the target’s name.
• Caution banner: Although most of us are now used to ignoring warning banners—this email is a perfect example of why we should not. The banner is intended to make us double-check the details of an email from an external origin—just to be sure.
• Inconsistent use of the DocuSign name: Although the term appears several times in the email details, “DocuShared” is actually a Xerox product.
• Missing security details: Though casual users might not know to look for this security feature, DocuSign emails will always provide an alternative method to validate any requests for a signature. All DocuSign signature requests contain a unique security code that allows users to access their file directly from the official DocuSign website. This information has been intentionally cut off from the bottom of the image in our fraudulent email.

Suspicious subject lines and content

Although our example email did not use this particular tactic, DocuSign has previously reported that emails including this content are likely spam.

• MS Office 365
• Windows Defender purchased order
• Order successfully
• Complete with DocuSign: Bot Content (90).html
• Fire wall protection order successfully placed

In late 2023, DocuSign also reported a new phishing scam in which bad actors impersonate HR departments. Those scams include the following subject lines.

• New Employee Benefit and Compensation & Salary Increment for your Review
• New Benefit and Compensation
• HR Sent you a document
• EMPLOYEE BENEFIT POLICY