Can a Real DocuSign Email Be a Scam?
Last reviewed: November 2026
Yes. A message sent through a legitimate document-signing service can still be part of a scam. The service may have delivered the notification correctly, but that does not establish that the person who created the envelope is trustworthy, that the document is genuine, or that an external link inside it is safe.
An illustrative signing notification. Click each numbered marker to see what it does, and does not, prove.
Hello,
Sarah Reynolds has invited you to sign the document Contract Agreement.
Please review and complete the document at your earliest convenience.
© DocuSign Inc. All rights reserved. Do not respond directly to this email. This message was sent to you by DocuSign on behalf of the sender above.
Marker 1: The sender address
The message genuinely passed through the signing platform's mail servers. SPF, DKIM and DMARC will all pass.
Who created the document. Anyone can open an account on a legitimate signing platform and send an envelope through it. A real domain proves delivery, not intent.
Why a genuine notification does not guarantee a genuine request
A scammer may create an account on a legitimate signing platform, send an unexpected envelope, and place deceptive instructions in the document. Alternatively, they may impersonate the platform with a lookalike email. In both cases, the aim may be to move you to a fake login page, persuade you to pay an invoice, or collect personal information.
The first case is especially tricky: the platform's email authentication may pass because the platform really did send the notification. Email authentication does not verify the sender's business claims or the safety of every document.
That is the detail that makes these attacks convincing. People learn to check the sender domain. Then they receive a notification from a real service and assume the document must be legitimate too. Those are two separate questions.
Five checks before you open or sign
Were you expecting this exact document?
Being familiar with the signing platform is not enough. Ask whether you expected a particular agreement from a particular person or organization. A surprise contract, payment form or payroll update deserves verification.
Verify the requester through a separate channel
Call a known contact or use the company's official website. Don't rely on a phone number or support address included in the unexpected request. If the document supposedly comes from a colleague, contact them through your normal workplace channel.
Watch for a second login page
A document that tells you to leave the signing platform, open an unrelated site, and enter your Microsoft, Google or company password is a serious warning sign. Some legitimate workflows involve authentication, so verify the requirement independently rather than assuming every login is fraudulent.
Inspect what you're being asked to approve
A request to change bank details, authorize a payment, share identification, or grant access to an account carries more risk than a routine document. Do not sign a document you don't understand just because the envelope looks professional.
Check the destination without interacting with it
If you can safely copy a suspicious URL, examine its actual hostname. Avoid following unfamiliar links to investigate them. A URL analysis tool may identify known indicators, but a clean result cannot validate the business purpose of the document. Don't submit private signing URLs containing access tokens to public scanning services.
Three common scenarios
The unexpected contract
You receive a signing request from a company you recognize, but nobody has told you a contract is coming. Verify the request with a known employee before opening or signing.
The locked document
A document claims you must open another website or sign into your email to unlock the content. Stop and confirm the process directly with the sender.
The payment update
A document asks you to change a supplier's bank account. Treat it as a payment-change request and verify the new details through an established callback procedure.
What if you already clicked?
The next step depends on what happened.
- Opened the notification or signing page only: Close it if unexpected, preserve the message for reporting, and verify with the supposed sender. Opening a page alone does not prove your device or account was compromised.
- Entered a password or one-time code: Open the legitimate service directly, change the affected password, revoke active sessions where supported, review MFA methods and recent activity, and alert your IT team if it is a work account.
- Downloaded a file: Do not open it. Use your device security tools or ask IT to assess it. If it ran, treat the event as potentially more serious.
- Signed or approved something: Contact the real organization promptly and ask about revocation or remediation. Seek legal advice if the document has contractual consequences.
- Sent money or bank details: Contact your bank's fraud team immediately using a trusted number.
Can PhishGlass help?
PhishGlass can help examine suspicious message text and URLs for phishing indicators and explain why a request looks risky. It cannot confirm that a contract is legally valid, that the named sender authorized it, or that a private document is safe to sign. Remove confidential information and sensitive access links before using any third-party analysis service.
Analyze a suspicious message with PhishGlassFrequently asked questions
Can a DocuSign email be real but the document fraudulent?
Yes. The notification can be sent by the real platform while the document or request was created by someone acting fraudulently.
Does a valid DocuSign domain prove the request is safe?
No. It helps identify the service delivering the message, not the legitimacy of the document's contents or the person requesting action.
Should I sign a document from someone I do not recognize?
Not before independently verifying who sent it, why it was sent, and what you're agreeing to.
What if the document asks for my Microsoft password?
Don't enter it through an unexpected link. Open the official service independently and confirm whether authentication is actually required.
Can a phishing checker verify a signing request?
It can help flag suspicious indicators, but it cannot independently establish the sender's identity, business authority, or the legal validity of a document.